Read the docs
TI-2025-38980 Aliases CVE-2025-62797

CSRF in FluxCP account endpoints allows account takeover / state-changing actions

Priority HIGH 72CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rathenaFluxCP< e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6—No fix listedCNA
  • FluxCP Vendorrathena Affected < e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62797

References

Other 2

  • TI-2026-80310 Origin validation error in rathena FluxCP PayPal IPN handler CVSS 4.0MEDIUM 6.9
  • TI-2025-36205 rAthena has heap-based buffer overflow in login server CVSS 3.1CRITICAL 9.8
  • TI-2025-36206 rAthena has SQL Injection in PartyBooking component via `WorldName` parameter. CVSS 3.1CRITICAL 9.8
  • TI-2025-36408 rAthena missing bound check in chclif_parse_moveCharSlot CVSS 3.1CRITICAL 9.1
  • TI-2024-30766 Javascript Injection in Vending Info/Buyers Info Module in FluxCP CVSS 3.1HIGH 7.3
  • TI-2025-38488 rAthena map-server use-after-free vulnerability in RODEX CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences