# CVE-2025-47227: ScriptCase - Authentication Bypass

> Live exploitation tracking for CVE-2025-47227 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-47227

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** ScriptCase
- **Weaknesses:** CWE-684 (Incorrect Provision of Specified Functionality)

## Description

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

## CrowdSec analysis

[CVE-2025-47227](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-47227) is a vulnerability in the Production Environment extension of Netmake ScriptCase through version 9.12.006, where improper handling of the administrator password reset mechanism allows unauthenticated attackers to take over the administrator account by making specific GET and POST requests to login.php. This flaw enables attackers to bypass authentication controls, potentially leading to full administrative access and control over the affected ScriptCase instance.

CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-47227 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit endpoints under `/prod/lib/php/devel/iface/`, such as `login.php` and `admin_sys_allconections_test.php`, to perform unauthorized password resets and remote command execution, often leveraging manipulated POST requests and bypassing authentication via crafted session cookies.

## Timeline

- 2025-07-05: CVE Published. CVE-2025-47227 is published to NVD.
- 2025-09-09: Rule Released. CrowdSec releases a rule to detect CVE-2025-47227 exploitation attempts against the CrowdSec Network.
- 2026-05-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-47227 for the first time.

## References

- https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
- https://www.scriptcase.net/changelog/
- https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution
- https://github.com/XiaomingX/data-cve-poc/blob/main/2025/CVE-2025-47227/CVE-2025-47227.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-47227) follows observed exploitation activity for CVE-2025-47227. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.