CVE-2025-63523: Feehi FeehiCMS Auth Bypass Vulnerability

CVE-2025-63523 Overview

CVE-2025-63523 is a server-side parameter validation bypass vulnerability in FeehiCMS version 2.1.1. The application fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify these parameters in transit, and the backend accepts the changes without proper validation. This vulnerability can lead to unintended username changes and potentially other unauthorized data modifications.

Critical Impact

Authenticated attackers can bypass client-side restrictions to modify read-only parameters, enabling unauthorized username changes and potential account manipulation in FeehiCMS installations.

Affected Products

• FeehiCMS version 2.1.1
• Feehi Feehicms (CPE: cpe:2.3:a:feehi:feehicms:2.1.1:*:*:*:*:*:*:*)

Discovery Timeline

• 2025-12-01 - CVE-2025-63523 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-63523

Vulnerability Analysis

This vulnerability represents a classic case of client-side trust without server-side validation. FeehiCMS version 2.1.1 presents certain parameters as read-only in the user interface, giving users the impression that these values cannot be modified. However, the application relies solely on client-side controls to enforce this restriction.

The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates:

• Attack Vector: Network-based exploitation
• Attack Complexity: Low - no special conditions required
• Privileges Required: None (though authenticated access to the CMS is needed)
• User Interaction: None required
• Impact: Low confidentiality and integrity impact with no availability impact

The EPSS (Exploit Prediction Scoring System) probability is 0.034% (9.335 percentile), indicating a relatively low likelihood of exploitation in the wild.

Root Cause

The root cause of this vulnerability is improper input validation on the server side. The application architecture assumes that client-side "read-only" field designations will prevent modification of sensitive parameters. This violates a fundamental security principle: never trust client-side input.

When a user submits form data containing parameters marked as read-only on the frontend, the backend does not verify whether those parameters should be immutable. Instead, it accepts and processes all submitted values, including those that should be protected from modification.

The CWE classification (CWE-125) suggests issues related to input boundary conditions, though the primary vulnerability type is Broken Access Control and Improper Input Validation.

Attack Vector

The attack leverages the network-accessible nature of the FeehiCMS application. An authenticated attacker can exploit this vulnerability through the following mechanism:

1. The attacker authenticates to the FeehiCMS application with valid credentials
2. The attacker navigates to a page containing read-only parameters (such as the username field)
3. Using a proxy tool (such as Burp Suite) or browser developer tools, the attacker intercepts the HTTP request
4. The attacker modifies the read-only parameter value in the intercepted request
5. The modified request is forwarded to the server
6. The server accepts the modified parameter without validation, applying the unauthorized change

The vulnerability mechanism relies on intercepting HTTP traffic between the client and server. When the application renders form fields as read-only using HTML attributes or JavaScript, this only prevents modification in the browser interface. An attacker with knowledge of the underlying HTTP request structure can bypass these client-side controls entirely by manipulating the raw request data before it reaches the server.

For detailed technical information and proof-of-concept details, refer to the vendor advisory on GitHub and the CVE documentation.

Detection Methods for CVE-2025-63523

Indicators of Compromise

• Unexpected username changes in user accounts without corresponding legitimate user activity
• HTTP POST requests containing modified values for parameters that should be read-only
• Audit log entries showing parameter changes that bypass normal user interface workflows
• Multiple rapid parameter modification requests from the same session

Detection Strategies

Organizations running FeehiCMS 2.1.1 should implement the following detection strategies:

Web Application Firewall (WAF) Rules: Configure WAF rules to detect and alert on HTTP requests that contain unexpected modifications to parameters that should be immutable. This requires knowledge of which parameters should be protected.

Server-Side Logging: Enable comprehensive logging of all parameter changes, particularly for sensitive fields like usernames. Compare submitted values against expected read-only values to identify manipulation attempts.

Behavioral Analysis: Monitor for patterns of parameter modification that deviate from normal user behavior, such as changes to fields that users typically do not modify through the standard interface.

SentinelOne Singularity Platform: Organizations using SentinelOne can leverage behavioral AI detection to identify anomalous web application activity. The platform's ability to correlate network traffic with application behavior can help identify exploitation attempts.

Monitoring Recommendations

• Implement audit logging for all user profile and account modifications
• Monitor HTTP traffic for requests containing parameters that should be server-controlled
• Set up alerts for username changes that occur outside of expected administrative workflows
• Regularly review access logs for signs of proxy-based request manipulation
• Consider implementing Content Security Policy headers and request integrity checks

How to Mitigate CVE-2025-63523

Immediate Actions Required

• Update FeehiCMS to a patched version when available from the vendor
• Implement server-side validation for all parameters, regardless of client-side restrictions
• Add authorization checks to verify that users are permitted to modify specific parameters
• Enable comprehensive audit logging for all parameter modifications
• Consider implementing request signing or integrity verification mechanisms

Patch Information

As of the last NVD update on 2025-12-02, organizations should monitor the official FeehiCMS GitHub repository for security patches addressing this vulnerability. The vendor advisory provides ongoing updates regarding the remediation status.

Until an official patch is available, organizations should implement the workarounds described below and consider the risk exposure of their FeehiCMS deployment.

Workarounds

If immediate patching is not possible, implement the following workarounds to reduce risk:

Server-Side Validation: Modify the application code to explicitly validate that read-only parameters cannot be modified by comparing submitted values against stored values before processing updates. For the username field specifically, ensure the server rejects any modification attempts through standard form submissions.

Web Application Firewall: Deploy or configure a WAF to filter requests containing modifications to known read-only parameters. Block or alert on requests that attempt to change protected fields.

Access Control Enhancement: Implement additional authorization checks at the controller or model level to verify that the current user has permission to modify specific parameters.

Network Segmentation: Limit network access to the FeehiCMS administrative interface to trusted networks only, reducing the attack surface for authenticated attacks.

Session Hardening: Implement strict session management controls including shorter session timeouts and IP binding to limit the window of opportunity for authenticated attackers.