CVE-2025-12223: Bdtask Flight Booking Software Package Information package-information unrestricted upload
A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12223?
CVE-2025-12223 is rated as critical due to its potential for unrestricted file uploads.
How do I fix CVE-2025-12223?
To mitigate CVE-2025-12223, update Bdtask Flight Booking Software to version 3.2 or later.
What component is affected by CVE-2025-12223?
CVE-2025-12223 affects the Package Information Module in the Bdtask Flight Booking Software.
Can CVE-2025-12223 be exploited remotely?
Yes, CVE-2025-12223 can be exploited remotely, allowing attackers to upload files without restriction.
What versions of Bdtask Flight Booking Software are vulnerable to CVE-2025-12223?
Bdtask Flight Booking Software versions up to and including 3.1 are vulnerable to CVE-2025-12223.