CVE-2025-65670
📋 TL;DR
This IDOR vulnerability in classroomio 0.1.13 allows students to temporarily access admin/teacher endpoints by manipulating course IDs in URLs, leading to unauthorized disclosure of sensitive course, admin, and student data. All users of classroomio 0.1.13 are affected, particularly educational institutions using this software for course management.
💻 Affected Systems
- classroomio
📦 What is this software?
Classroomio by Classroomio
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all course data including admin credentials, student records, and sensitive educational materials, potentially leading to data breaches and privacy violations.
Likely Case
Students accessing teacher/admin dashboards to view grades, assignments, and other student data they shouldn't see, with potential for grade manipulation or data theft.
If Mitigated
Minimal impact with proper access controls and monitoring, where unauthorized access is quickly detected and contained.
🎯 Exploit Status
Exploitation requires student-level authentication but is trivial once authenticated; public PoC available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: unknown
Restart Required: No
Instructions:
Check GitHub repository for updates; upgrade to patched version when available.
🔧 Temporary Workarounds
Implement Proper Access Controls
allAdd server-side authorization checks for all endpoints to verify user permissions before granting access.
Use Indirect Object References
allReplace direct object references with indirect references or tokens that cannot be easily manipulated.
🧯 If You Can't Patch
- Implement network segmentation to isolate classroomio from sensitive systems
- Enable detailed logging and monitoring for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Test if authenticated student can access admin endpoints by manipulating course ID parameters in URLs.Check Version:
Check package.json or application version endpoint for classroomio versionVerify Fix Applied:
Verify that server-side authorization checks prevent unauthorized access regardless of URL manipulation.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns from student accounts to admin endpoints
- Multiple failed authorization attempts followed by successful access
Network Indicators:
- HTTP requests with manipulated course ID parameters to admin endpoints
SIEM Query:
source="classroomio" AND (url="*/admin/*" OR url="*/teacher/*") AND user_role="student"