CVE-2025-61148
📋 TL;DR
An Insecure Direct Object Reference (IDOR) vulnerability in EduplusCampus 3.0.1 allows authenticated users to access other students' personal and financial records by manipulating the 'rec_no' parameter in the payment API. This affects all universities and educational institutions using EduplusCampus 3.0.1 with the vulnerable Student Payment API endpoint exposed.
💻 Affected Systems
- EduplusCampus
📦 What is this software?
Edupluscampus by Edupluscampus
⚠️ Risk & Real-World Impact
Worst Case
Mass data breach exposing sensitive personal information (names, addresses, financial records) and payment details of all students in the system, potentially leading to identity theft and financial fraud.
Likely Case
Targeted data theft where malicious actors access specific students' records for harassment, blackmail, or credential reuse attacks.
If Mitigated
Limited exposure if proper access controls and parameter validation are implemented, restricting users to only their own records.
🎯 Exploit Status
Exploitation requires authenticated access but involves simple parameter manipulation. Public proof-of-concept code and detailed write-up available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Implement workarounds immediately.
🔧 Temporary Workarounds
Implement Server-Side Access Control
allAdd server-side validation to ensure users can only access their own records by checking user session/identity against requested rec_no.
Web Application Firewall Rule
allDeploy WAF rules to block suspicious parameter manipulation patterns in the /student/get-receipt endpoint.
🧯 If You Can't Patch
- Disable or restrict access to the /student/get-receipt endpoint if not essential
- Implement network segmentation to isolate the EduplusCampus system and limit access to authorized users only
🔍 How to Verify
Check if Vulnerable:
Authenticate as a student user, access /student/get-receipt endpoint with your rec_no, then modify rec_no parameter to another student's value. If you can access another student's receipt, system is vulnerable.Check Version:
Check EduplusCampus admin panel or configuration files for version information (typically shows 3.0.1 in vulnerable installations).Verify Fix Applied:
After implementing controls, repeat the test. System should return 'access denied' or similar error when attempting to access another student's records.📡 Detection & Monitoring
Log Indicators:
- Multiple failed access attempts to /student/get-receipt with different rec_no values from same user session
- Unusual pattern of receipt access outside normal user behavior
Network Indicators:
- HTTP requests to /student/get-receipt with rec_no parameters that don't match the authenticated user's expected range
SIEM Query:
source="web_server" AND uri_path="/student/get-receipt" AND rec_no!=user_authorized_rec_no