TRUfusion Enterprise 未授权访问漏洞(CVE-2025-27225)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-27225
• https://cn-sec.com/archives/4545457.html
• https://www.gm7.org/archives/14873
• https://cn-sec.com/archives/4545962.html
• https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
• https://www.rcesecurity.com/advisories/cve-2025-27225/
• https://docs.rocketsoftware.com/bundle/trufusion_security_71110/page/topics/kmr1771912821581.html
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27225.yaml
• https://www.sentinelone.com/vulnerability-database/cve-2025-27225/

Related Vulnerabilities

• PoCCVE-2026-20253: Splunk Enterprise & Cloud Platform - Unrestricted File Upload
• TRUfusion Enterprise /trufusionPortal/getProjectList 权限绕过漏洞（CVE-2025-27223）
• 智能环保云平台 /Enterprise/CreateCode_Simple SQL 注入漏洞
• PoCTRUfusion Enterprise /trufusionPortal/getCobrandingData 文件读取漏洞（CVE-2025-27222）
• PoCCVE-2025-32355: Rocket TRUfusion Enterprise - Server Side Request Forgery
• PoC安科瑞-智能环保云平台 /MainMonitor/GetEnterpriseInfoMapByDate/GetDates SQL 注入漏洞
• Elastic Cloud Enterprise 访问控制不当漏洞 可导致权限提升
• TRUfusion Enterprise 认证绕过漏洞(CVE-2025-27223)
• TRUfusion Enterprise 目录遍历漏洞(CVE-2025-27222)
• 安科瑞-GetEnterpriseInfoMapHM-SQL注入
• Kingdee Cloud-Starry-Sky Enterprise Edition 路径遍历漏洞