Vulnerability · Published May 11, 2025 · Assigned by VulDB

CVE-2025-4542Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy

Low 3.1

In plain English

A low-severity security flaw in Hotel 酒店管理系统 API from Freeebird. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 79.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Freeebird	Hotel 酒店管理系统 API	1.01.11.2

Weakness: CWE-942, CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-308288 | Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy vdb-entry
VDB-308288 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #567214 | freeebird hotel 1.2 branch Permissive Cross-domain Policy with Untrusted Domains third-party-advisory
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md exploit