CVE-2025-3849
📋 TL;DR
This vulnerability allows remote attackers to change student passwords without proper verification in the SpringBoot-Vue-OnlineExam system. By manipulating the studentId parameter in the /api/studentPWD endpoint, attackers can modify passwords for arbitrary student accounts. This affects all deployments of version 1.0 of the SpringBoot-Vue-OnlineExam software.
💻 Affected Systems
- YXJ2018 SpringBoot-Vue-OnlineExam
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could change passwords for all student accounts, causing widespread account lockouts, exam disruption, and potential unauthorized access to student data and exam submissions.
Likely Case
Targeted password changes for specific students, leading to account takeover, exam manipulation, and potential grade tampering.
If Mitigated
With proper authentication and authorization controls, impact would be limited to authorized users only making legitimate password changes.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issue #74, making this easily exploitable by attackers with basic web application knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check the GitHub repository for any security patches or updates. 2. If no official patch exists, implement proper authentication and authorization checks in the /api/studentPWD endpoint. 3. Validate that only authenticated users can change their own passwords or that administrators follow proper verification procedures.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock or monitor requests to the vulnerable /api/studentPWD endpoint
WAF specific - configure rule to block POST requests to /api/studentPWD with suspicious parameters
Network Access Control
allRestrict access to the application to trusted networks only
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port port="APP_PORT" protocol="tcp" accept'
netsh advfirewall firewall add rule name="Restrict OnlineExam" dir=in action=allow protocol=TCP localport=APP_PORT remoteip=TRUSTED_NETWORK
🧯 If You Can't Patch
- Implement strong authentication and session management to prevent unauthorized access to password change functionality
- Deploy a web application firewall with rules specifically targeting the /api/studentPWD endpoint
🔍 How to Verify
Check if Vulnerable:
Test if you can change a student password via POST request to /api/studentPWD without proper authentication or by manipulating the studentId parameterCheck Version:
Check application version in package.json or build configuration filesVerify Fix Applied:
Verify that password changes now require proper authentication and that users can only change their own passwords or that administrators follow verification procedures📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /api/studentPWD from single IP
- Password change requests with different studentId values from same source
- Failed login attempts followed by password reset requests
Network Indicators:
- Unusual traffic patterns to /api/studentPWD endpoint
- POST requests to /api/studentPWD with manipulated studentId parameters
SIEM Query:
source="web_server" AND (url="/api/studentPWD" AND method="POST") | stats count by src_ip, studentId