CVE-2025-52289: MagnusBilling Privilege Escalation Flaw

CVE-2025-52289 Overview

CVE-2025-52289 is a Broken Access Control vulnerability [CWE-269] in MagnusBilling v7.8.5.3, an open-source billing solution for Asterisk-based VoIP platforms. Newly registered users can self-activate their own accounts by sending a crafted request to /mbilling/index.php/user/save. The flaw lets attackers flip their account status from pending to active without administrator approval. Successful exploitation grants access to billing functions and tenant data that should require manual review.

Critical Impact
Authenticated low-privilege users can escalate privileges by bypassing administrator approval, gaining access to confidential billing data and platform functionality intended for active customers only.

Affected Products

MagnusSolution MagnusBilling 7.8.5.3
Deployments using the mbilling web interface
Self-registration enabled MagnusBilling instances

Discovery Timeline

2025-07-31 - CVE-2025-52289 published to NVD
2025-08-06 - Last updated in NVD database

Technical Details for CVE-2025-52289

Vulnerability Analysis

The vulnerability resides in the user account management endpoint /mbilling/index.php/user/save. MagnusBilling exposes this endpoint to handle user profile updates, but it fails to enforce authorization on the active field within the request payload. A self-registered user normally enters a pending state until an administrator approves the account. By submitting a crafted POST request that includes active=1, the user mutates their own status directly in the database.

The outcome is vertical privilege escalation: the attacker transitions from an inert pending registrant to a fully active platform user. Active accounts can place calls, consume billing credit, query customer data, and interact with downstream Asterisk functionality. In multi-tenant deployments this exposes confidential subscriber records and call detail records (CDRs).

Root Cause

The root cause is improper privilege management [CWE-269]. The user/save controller treats fields supplied by the client as trusted input and applies them to the user record without verifying that the caller is authorized to modify privileged attributes such as active. Approval logic is enforced only in the administrator user interface, not server-side. The vendor commit f886330e9e9216a3830775610a4a83f970c08e8d addresses this by restricting which user attributes a self-service request may modify.

Attack Vector

Exploitation requires network access to the MagnusBilling web interface and a valid pending account, which any visitor can create when self-registration is enabled. The attacker authenticates with the pending credentials, then issues an authenticated request to /mbilling/index.php/user/save containing the active parameter set to 1 and their own user identifier. The server persists the change and the account becomes active on the next session check. No administrator interaction is required.

For technical specifics, refer to the GitHub PoC Repository for CVE-2025-52289.

Detection Methods for CVE-2025-52289

Indicators of Compromise

POST requests to /mbilling/index.php/user/save originating from sessions belonging to recently registered, non-administrator accounts.
User records transitioning from pending to active status without a corresponding administrator audit log entry.
Short intervals (seconds to minutes) between account registration and first authenticated billing API call.

Detection Strategies

Inspect web server access logs for user/save requests where the request body contains active=1 and the session user identifier matches the target user identifier.
Correlate database audit trails on the users table with administrator session activity to surface status changes that lack an approving admin.
Alert on newly active accounts that perform privileged actions within minutes of registration.

Monitoring Recommendations

Forward MagnusBilling Apache or Nginx logs to a centralized logging platform and apply rules that match the user/save endpoint with active in the payload.
Enable MySQL or MariaDB general query logging for the MagnusBilling schema to capture UPDATE statements against the users table.
Review administrator approval queues daily and reconcile against the count of active users created in the same period.

How to Mitigate CVE-2025-52289

Immediate Actions Required

Upgrade MagnusBilling to a version that includes commit f886330e9e9216a3830775610a4a83f970c08e8d or later.
Audit all user accounts created since deployment and revert any unauthorized active status changes to pending.
Disable public self-registration until the patch is applied if business requirements allow.

Patch Information

The vendor published the fix in commit f886330e9e9216a3830775610a4a83f970c08e8d. Refer to the GitHub Commit Note on MagnusBilling for the exact code changes. The patch restricts which user record fields the user/save action may modify when invoked by a non-administrator session.

Workarounds

Place the MagnusBilling administration interface behind a VPN or IP allowlist to limit who can reach the user/save endpoint.
Add a web application firewall (WAF) rule that blocks POST requests to /mbilling/index.php/user/save containing the active parameter from non-administrator sessions.
Require manual database review before any user transitions from pending to active until the official patch is deployed.

bash

# Example WAF rule (ModSecurity) blocking unauthorized active flag changes
SecRule REQUEST_URI "@streq /mbilling/index.php/user/save" \
    "id:1052289,phase:2,deny,status:403,\
     chain,msg:'CVE-2025-52289 MagnusBilling privilege escalation attempt'"
    SecRule ARGS:active "@streq 1" \
        "chain"
        SecRule REQUEST_HEADERS:Cookie "!@rx admin_session" "t:none"