PT-2025-2008 · Beijing Yunfan Internet Technology · Yunfan Learning Examination System
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Beijing Yunfan Internet Technology Yunfan Learning Examination System version 1.9.2
Description
A problematic issue has been found in the Beijing Yunfan Internet Technology Yunfan Learning Examination System. It affects an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java, which is part of the Exam Answer Handler component. This issue leads to information disclosure and can be exploited remotely. The exploit has been made public.
Recommendations
For version 1.9.2, consider restricting access to the Exam Answer Handler component until a patch is available. As a temporary workaround, avoid using the affected function in the PaperController.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.
Exploit
Fix
Improper Access Control
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Yunfan Learning Examination System