CVE-2025-69612
📋 TL;DR
This path traversal vulnerability in TMS Management Console allows authenticated users to read arbitrary files on the server by manipulating the filePath parameter in the Download Template function. Attackers can access sensitive files like Web.config containing configuration secrets. Only version 6.3.7.27386.20250818 of TMS Management Console is affected.
💻 Affected Systems
- TMS Management Console
📦 What is this software?
Tms Management Console by Tmsglobalsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive configuration files, database credentials, and other system files, potentially leading to full server compromise and data exfiltration.
Likely Case
Authenticated users or attackers who obtain credentials read Web.config and other sensitive files to harvest credentials and configuration data for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the application server's file system without lateral movement.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates reading Web.config. Exploitation requires valid user credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://tmsglobalsoft.com/
Restart Required: No
Instructions:
Check vendor website for security updates. No official patch information available at this time.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject filePath parameters containing directory traversal sequences (../, ..\)
Access Control Restriction
allRestrict access to the Management Console interface to trusted IP addresses only
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests containing directory traversal patterns
- Monitor and alert on access to sensitive files like Web.config from the Management Console application
🔍 How to Verify
Check if Vulnerable:
Test the Download Template function with a filePath parameter containing ../Web.config. If the file is returned, the system is vulnerable.Check Version:
Check application version in Management Console interface or application filesVerify Fix Applied:
Retest the Download Template function with traversal sequences. Successful fix should return an error or sanitized path.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to Download Template endpoint with ../ patterns in parameters
- Access to Web.config or other sensitive files from Management Console process
Network Indicators:
- HTTP GET/POST requests containing ../ sequences in URL parameters
SIEM Query:
source="web_server" AND (uri="*DownloadTemplate*" AND (param="*../*" OR param="*..\\*"))