AiDex up to 1.6 /api//message automated recognition mechanism with inadequate detection or handling of adversarial input perturbations

Summaryinfo

A vulnerability has been found in AiDex up to 1.6 and classified as critical. The impacted element is an unknown function of the file /api//message. The manipulation leads to automated recognition mechanism with inadequate detection or handling of adversarial input perturbations. This vulnerability is referenced as CVE-2025-3578. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in AiDex up to 1.6. It has been rated as critical. This issue affects an unknown part of the file /api//message. The manipulation with an unknown input leads to a automated recognition mechanism with inadequate detection or handling of adversarial input perturbations vulnerability. Using CWE to declare the problem leads to CWE-1039. The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the exfiltration of sensitive information, such as details about the software or internal system paths. These actions could be carried out through the misuse of LLM Prompt (chatbot) technology, via the /api//message endpoint, by manipulating the contents of the ‘content’ parameter.

The weakness was published by David Utón Amaya. The advisory is shared at incibe.es. The identification of this vulnerability is CVE-2025-3578 since 04/14/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.7 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• AiDex

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion