Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-67223. PoCs published by brandonperezlara.
AI-analyzed exploit summary The repository contains a functional Python script that exploits CVE-2025-67223, an information disclosure vulnerability in Aranda Service Desk. The script automates the retrieval of log files from predictable paths and extracts sensitive file paths for unauthorized access.
Description
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.
Exploits (1)
The repository contains a functional Python script that exploits CVE-2025-67223, an information disclosure vulnerability in Aranda Service Desk. The script automates the retrieval of log files from predictable paths and extracts sensitive file paths for unauthorized access.
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N