CVEvulnerability

CVE-2025-61148

6.5 MEDIUM Published 2025-12-04 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-12-04
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-639

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.

Affected configurations

• edupluscampus edupluscampus 3.0.1

Weakness · CWE (1)

CWE-639 Authorization Bypass Through User-Controlled Key weakness

References

https://drive.google.com/file/d/1BRZRurbl7TY6KU4uaelAUn7L9Cn6XfjC/view?usp=sharing Exploit, Third Party Advisory
https://github.com/sharma19d/CVE-2025-61148 Exploit, Third Party Advisory
https://medium.com/@Charon19d/how-i-hacked-all-universities-in-my-city-d6b8e320455c Product

CVE-2025-61148

Description

Affected configurations

Related

Weakness · CWE (1)

References