PT-2025-17857 · Unknown · Codeastro Bus Ticket Booking System

Published 2025-04-24 · Updated 2025-05-28 · CVE-2025-25777

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Codeastro Bus Ticket Booking System version 1.0

Description Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.

Recommendations For Codeastro Bus Ticket Booking System version 1.0, as a temporary workaround, consider validating and sanitizing the user ID parameter in the URL to prevent unauthorized access to user profiles. Restrict access to sensitive user profile information until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-25777

Affected Products

Codeastro Bus Ticket Booking System

References · 11

• 🔥 https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25777 · Exploit
• https://osv.dev/vulnerability/CVE-2025-25777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25777 · Security Note
• https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code · Note
• https://t.me/cvetracker/22324 · Telegram Post
• https://twitter.com/CVEnew/status/1915519185301471607 · Twitter Post
• https://twitter.com/CVETracker/status/1915858539169333360 · Twitter Post
• https://t.me/cvenotify/119834 · Telegram Post
• https://twitter.com/dailycve/status/1927761785324453915 · Twitter Post
• https://t.me/cvenotify/123832 · Telegram Post
• https://t.me/cvedetector/23707 · Telegram Post