PT-2025-22812 · Schule · Schule

Ibnusued · Published 2025-05-23 · Updated 2025-05-24 · CVE-2025-48375

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Schule versions prior to 1.0.1

Description The issue concerns a lack of proper rate limiting controls in the file forgot password.php, which is responsible for email-based OTP generation. This allows attackers to abuse the OTP request functionality, potentially leading to denial-of-service (DoS) conditions or facilitating user harassment through email flooding.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 to resolve the issue. As a temporary workaround, consider implementing rate limiting controls on the forgot password.php file or equivalent endpoint to minimize the risk of exploitation. Restrict access to the forgot password.php file to prevent abuse of the OTP request functionality until the update is applied.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-48375

GHSA-H3F2-MC85-67GC

Affected Products

Schule

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48375.json · Exploit
• 🔥 https://github.com/schule111/Schule/security/advisories/GHSA-h3f2-mc85-67gc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48375 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48375 · Vendor Advisory
• https://twitter.com/CVEnew/status/1926244422334677058 · Twitter Post
• https://t.me/cvetracker/24554 · Telegram Post