CVE-2025-70841
CriticalSummary
Dokans Multi-Tenancy Based eCommerce Platform SaaS w wersji 3.9.2 pozwala nieautoryzowanym zdalnym atakującym na uzyskanie wrażliwych danych konfiguracyjnych aplikacji poprzez bezpośrednie żądanie do pliku /script/.env. Ujawniony plik zawiera klucz szyfrowania aplikacji Laravel (APP_KEY), dane uwierzytelniające bazy danych, dane uwierzytelniające SMTP/SendGrid oraz wewnętrzne parametry konfiguracyjne.
Risk Assessment
Ta podatność umożliwia całkowite przejęcie systemu, w tym obejście uwierzytelniania poprzez fałszowanie tokenów sesji, bezpośredni dostęp do bazy danych wszystkich danych najemców oraz przejęcie infrastruktury e-mailowej. Ze względu na architekturę wielonajemczości, podatność ta dotyczy wszystkich najemców w systemie.
Recommendation
Zaleca się zabezpieczenie pliku .env przed dostępem zdalnym oraz wdrożenie odpowiednich mechanizmów uwierzytelniania i autoryzacji. Należy również przeprowadzić audyt bezpieczeństwa systemu oraz zaktualizować aplikację do najnowszej wersji.
Related vulnerabilities
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66565Critical
The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66564Critical
The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS