CVE-2025-25330
📋 TL;DR
This vulnerability in Boohee Health iOS app allows attackers to access sensitive user information by tricking users into clicking a maliciously crafted link. It affects users of Boohee Health iOS app version 13.0.13. The issue stems from improper handling of URL schemes or deep links.
💻 Affected Systems
- Boohee Technology Boohee Health iOS app
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive personal health data, authentication tokens, or private user information stored within the app.
Likely Case
Targeted phishing campaigns could steal user session data or personal information through malicious links.
If Mitigated
With proper URL validation and sandboxing, impact would be limited to non-sensitive app data.
🎯 Exploit Status
Exploitation requires user to click malicious link. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Monitor Boohee Technology for security updates. 2. Update app through Apple App Store when patch becomes available. 3. No restart required for app updates.
🔧 Temporary Workarounds
Disable app URL schemes
iosPrevent app from handling custom URL schemes through iOS restrictions
User education
allTrain users not to click untrusted links, especially those claiming to be from Boohee Health
🧯 If You Can't Patch
- Restrict app permissions to minimum required functionality
- Implement network monitoring for suspicious data exfiltration from the app
🔍 How to Verify
Check if Vulnerable:
Check app version in iOS Settings > General > iPhone Storage > Boohee HealthCheck Version:
Not applicable - check through iOS SettingsVerify Fix Applied:
Verify app version is newer than 13.0.13 after update📡 Detection & Monitoring
Log Indicators:
- Unusual URL scheme activations
- Sensitive data access from unexpected sources
Network Indicators:
- Unexpected outbound connections after clicking links
- Data exfiltration patterns
SIEM Query:
Not applicable for mobile app vulnerability