PT-2025-22563 · Schule · Schule

Ibnusued · Published 2025-05-22 · Updated 2025-05-22 · CVE-2025-48373

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Schule versions prior to 1.0.1

Description The issue concerns the Schule open-source school management system software, which relies on client-side JavaScript to redirect users to different panels based on their role. This implementation poses a security risk because it assumes the value of data.role is trustworthy on the client side. Attackers can manipulate JavaScript in the browser and set data.role to any arbitrary value, gaining unauthorized access to restricted areas of the application.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider implementing server-side validation of user roles to prevent unauthorized access. Restrict access to sensitive areas of the application until the update is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-48373

GHSA-37H9-QQ7C-6MC9

Affected Products

Schule

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48373.json · Exploit
• https://github.com/schule111/Schule/commit/cbf7f509c37acd69b4ab8ee19d842de867b46b7e · Patch
• https://github.com/schule111/Schule/security/advisories/GHSA-37h9-qq7c-6mc9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48373 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48373 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925656008623280295 · Twitter Post