Introduction#

Earlier this year, I was tasked with conducting an external penetration test for a client. The scope was relatively small compared to the larger engagements we usually handle: just three IP addresses and three domains. Initially, I didn’t expect to uncover much, as no unnecessary ports or services were exposed, keeping their attack surface to a minimum. The client also mentioned that their internal red team had already conducted a brief review. However, little did I know that this engagement would lead to the discovery of two CVEs (CVE-2025-51682 and CVE-2025-51683)…

Disclosure Timeline#

Technical details#

The application I focused on only presented a login screen. A static analysis of the frontend code revealed some interesting endpoints and behaviors, such as a check to see if the username was set to SUPERVISOR:

if (twofact) {
    var returnVal = "";
    var user = $('#UserName').val().trim();
    if (user.toUpperCase() == "SUPERVISOR") {
        returnVal = "AdminScreen.aspx";
}
else {
    var tempUserID = $('#UserName').val().trim();
    tempUserID = tempUserID.toUpperCase();
    tempUserID = tempUserID.replace("ADMIN/", "");
    setLocalStorage('UserID', tempUserID);
    returnVal = "Default.aspx";
}

Setting the username to SUPERVISOR in the front end, without successfully logging in, was sufficient to access the endpoint AdminScreen.aspx. The website then sent a request containing the user ID SUPERVISOR:

{
    'Method':'get_admin_screen_object() --> onDocumentLoad() (js/Admin.js) --> 
        $(document).ready()(AdminScreen.aspx)','userid':'SUPERVISOR'
}

This request returned all usernames along with additional information about the application. Depending on the configuration, it could also expose SMTP credentials in clear text.

"Settings\": [
      ...
      {
        \"COMPANY\": 1,
        \"UserID\": \"redacted\",
        ...
        \"SMTP_HOST\": \"\",
        \"SMTP_PORT\": 0,
        \"SMTP_USE_SSL\": false,
        \"SMTP_Login\": \"\",
        \"SMTP_Cred\": \"\",
        ...
      },
      {
        \"COMPANY\": 1,
        \"UserID\": \"redacted\",
        ...
      },
      ...
]

The next code block caught my attention, as it revealed a hidden menu when the user pressed Ctrl+Space:

$(document).on('keydown', function (e)
    {
    //ctrl + space
    if (e.ctrlKey && e.which === 32) {
        if ($('#code').css('display') != 'inline') {
            $('#code_pass').val('');
            InvisNative('offlineLogin');
            $('#code').css('display', 'inline');
            InvisNative('Login_Type_Tabs');
            $('#code_pass').focus();
        }
    }
    ...
}

A new form appeared, prompting me for an authentication token. Upon examining an example request sent, I noticed that the server responded with the message fail:

After intercepting the response and changing it to success, I was presented with a fully functional administrative interface:

The SQL window is a dream for attackers. When executing a query, a pop-up appears displaying the response. For example, I ran a query to list the contents of the directory C:\Users:

The App Config tab conveniently displays the configuration of the web application, including the insecure default password for the database:

In addition to the other interesting tabs, such as the log files, all configurations could not only be viewed but also updated, all without the need to log in.