ScriptCase - Authentication Bypass (CVE-2025-47227)
Description
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
psychologyCrowdSec Analysis
CVE-2025-47227 is a vulnerability in the Production Environment extension of Netmake ScriptCase through version 9.12.006, where improper handling of the administrator password reset mechanism allows unauthenticated attackers to take over the administrator account by making specific GET and POST requests to login.php. This flaw enables attackers to bypass authentication controls, potentially leading to full administrative access and control over the affected ScriptCase instance.
CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-47227 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit endpoints under /prod/lib/php/devel/iface/, such as login.php and admin_sys_allconections_test.php, to perform unauthorized password resets and remote command execution, often leveraging manipulated POST requests and bypassing authentication via crafted session cookies.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-07-05 |
| Rule Released | 2025-09-09 |
| CrowdSec First Seen | 2026-05-22 |