CVE-2025-54378

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969	Patch
https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd	Patch
https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894	Exploit Third Party Advisory
https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*
	cpe:2.3:a:psu:haxcms-php::::::::

History

No history.

Information

Published : 2025-07-26 04:16

Updated : 2025-08-21 20:54

NVD link : CVE-2025-54378

Mitre link : CVE-2025-54378

CVE.ORG link : CVE-2025-54378

JSON object : View

Products Affected

psu

haxcms-nodejs
haxcms-php

CWE

CWE-285

Improper Authorization

CWE-862

Missing Authorization

{"id": "CVE-2025-54378", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2025-07-26T04:16:05.967", "references": [{"url": "https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php."}, {"lang": "es", "value": "HAX CMS permite gestionar el universo de micrositios con backends PHP o NodeJs. En las versiones 11.0.13 y anteriores de haxcms-nodejs y 11.0.8 y anteriores de haxcms-php, los endpoints de la API no realizan comprobaciones de autorizaci\u00f3n al interactuar con un recurso. Tanto la versi\u00f3n JS como la PHP del CMS no verifican que un usuario tenga permiso para interactuar con un recurso antes de realizar una operaci\u00f3n. Los endpoints de la API dentro de la aplicaci\u00f3n HAX CMS comprueban si un usuario est\u00e1 autenticado, pero no comprueban la autorizaci\u00f3n antes de realizar una operaci\u00f3n. Esto se ha corregido en las versiones 11.0.14 de haxcms-nodejs y 11.0.9 de haxcms-php."}], "lastModified": "2025-08-21T20:54:52.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3129AEF5-B4C5-4694-AE1F-9A402890B1E5", "versionEndExcluding": "11.0.14"}, {"criteria": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A74B72F-D438-44F9-9A3D-53CE9D8487A4", "versionEndExcluding": "11.0.9"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}