CVE-2025-71260
HIGH NUCLEIBMC FootPrints ITSM 20.20.02-20.24.01.001 - VIEWSTATE Deserialization Code Execution
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2025-71260. PoCs published by watchtowrlabs. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2025-71257 (authentication bypass) and CVE-2025-71260 (RCE) in BMC FootPrints. The script demonstrates the vulnerability chain by extracting a SEC_TOKEN, bypassing authentication, and writing a randomized JSP file to the Tomcat webroot to execute system commands.
Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2025-71257 (authentication bypass) and CVE-2025-71260 (RCE) in BMC FootPrints. The script demonstrates the vulnerability chain by extracting a SEC_TOKEN, bypassing authentication, and writing a randomized JSP file to the Tomcat webroot to execute system commands.
Nuclei Templates (1)
html:"/footprints/servicedesk/"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H