Critical ScriptCase Flaws Allow Remote Code Execution and Server Takeover

Security researchers Alexandre Droullé and Alexandre Zanni have publicly disclosed two critical vulnerabilities, CVE-2025-47227 and CVE-2025-47228, affecting the Production Environment module (prod console) of ScriptCase, a popular low-code PHP web application platform.

These flaws allow an attacker to achieve remote command execution on the server without prior authentication, posing a severe risk to organizations using vulnerable versions.

Authentication Bypass and Shell Injection

The attack chain exploits two distinct issues:

1. Authentication Bypass (CVE-2025-47227):

The prod console’s password reset feature can be abused to reset the administrator password without authentication.

The vulnerability lies in the changePass() function, which is triggered via the following POST request:

textPOST /scriptcase/prod/lib/php/devel/iface/login.php HTTP/1.1
Host: <target>
Cookie: PHPSESSID=attacker
Content-Type: application/x-www-form-urlencoded

ajax=nm&nm_action=change_pass&email=attacker@example.org&pass_new=NewPass123&pass_conf=NewPass123&lang=en-us&captcha=ABCD

The only requirements are a valid email, a new password, and a CAPTCHA value.

Crucially, the session variable nm_session.prod_v8.login.is_page is not properly checked, allowing attackers to bypass authentication by first initiating a GET request to set the session, then POSTing the password reset with the same PHPSESSID.

2. Remote Command Execution (CVE-2025-47228):

After resetting the password, the attacker can authenticate and exploit a command injection flaw in the SSH local port forwarding feature.

User-supplied input is concatenated directly into a shell_exec() call:

php$str_comando = "ssh -fNg -L $localPort:$server:$port $sshUser@$sshHost";
if(!empty($sshPort)) { $str_comando .= " -p " . $sshPort; }
if(!empty($cert)) { $str_comando .= " -i \"$cert\""; }
shell_exec($str_comando);

By injecting shell metacharacters (e.g., ; touch hacked ;#) into the ssh_localportforwarding parameter, arbitrary system commands can be executed as the web server user.

Exploitation, Impact, and Mitigation

A proof-of-concept Python script automates the entire attack, including CAPTCHA solving using OCR tools such as Tesseract:

bashpython exploit.py -u http://target/scriptcase -c "id"

Impact:

• Full compromise of the prod console, including database credentials and server access.
• No runtime logs are generated, making detection difficult.
• Vulnerable versions: Production Environment 1.0.003-build-2 (bundled with ScriptCase 9.12.006 (23)) and likely earlier releases.

Mitigation Recommendations:

• Restrict access to the prod console endpoints (/prod/lib/php/devel/iface/login.php, /prod/lib/php/nm_ini_manager2.php, etc.) at the reverse proxy or firewall level.
• Patch as soon as a fix is available.
• Review session maagement and sanitize all user input before passing to system commands.

These vulnerabilities underscore the crucial need for robust authentication checks and secure coding practices in administrative modules that are exposed to the internet.

Organizations using ScriptCase should act immediately to mitigate risk.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates