CVE-2025-61148: Edupluscampus: güvenlik açığı

Açıklama (NVD)

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Özet bilgiler

Ürün

Edupluscampus Edupluscampus

CVSS v3.1

6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

%0,37 (yüzdelik 31)

CWE

CWE-639

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• drive.google.com
• github.com
• medium.com
• CWE-639