CVE-2025-27980
📋 TL;DR
Cashbook v4.0.3 contains an arbitrary file read vulnerability in the /api/entry/flow/invoice/show endpoint. Attackers can exploit this to read sensitive files from the server filesystem. All users running the vulnerable version are affected.
💻 Affected Systems
- cashbook
📦 What is this software?
Cashbook by Oldmoon
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, SSH keys, database credentials, or other critical system files leading to lateral movement.
Likely Case
Exfiltration of sensitive business data, configuration files, or user information stored on the server filesystem.
If Mitigated
Limited impact if proper file permissions, web server restrictions, and network segmentation are implemented.
🎯 Exploit Status
Simple path traversal attack via the invoice parameter. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Web Server Input Validation
allImplement input validation at the web server level to block path traversal attempts.
# For Apache: Add to .htaccess
RewriteCond %{QUERY_STRING} invoice=.*\.\./ [NC]
RewriteRule ^ - [F]
Application Firewall Rule
allBlock requests containing path traversal sequences in the invoice parameter.
# Example WAF rule to block ../ patterns in query string
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication
- Implement strict file system permissions to limit what the web server can read
🔍 How to Verify
Check if Vulnerable:
Test by accessing /api/entry/flow/invoice/show?invoice=../../../../etc/passwd and checking for file contents in response.Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt the same test and verify that file contents are not returned (should show error or empty response).📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api/entry/flow/invoice/show with ../ patterns in query string
- Unusual file access patterns from web server process
Network Indicators:
- HTTP GET requests with path traversal sequences in query parameters
SIEM Query:
source="web_logs" AND uri_path="/api/entry/flow/invoice/show" AND query_string="*../*"