Vulnerability details

CVE-2025-62797

rathena FluxCP

CSRF in FluxCP account endpoints allows account takeover / state-changing actions

CVSS 4.0

8.6High

Official description

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
rathena	FluxCP	< e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6 x_refsource_MISC
https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-10-29
Last updated: 2025-10-29
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.24%

Probability of exploitation in 30 days

15.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-352
Cross-Site Request Forgery (CSRF)