CVE-2025-50870

CRITICAL

9.8

Description

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/1/2025

Last Modified8/4/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-284

References

https://cwe.mitre.org/data/definitions/284.html(cve@mitre.org)

https://gist.github.com/b0mk35h/c4d47b5c4aacecdc8e6c4b02b40ce302(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.