PT-2025-31656 · Unknown · Institute-Of-Current-Students

Pronay Biswas · Published 2025-08-01 · Updated 2025-08-01 · CVE-2025-50870

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Institute-of-Current-Students version 1.0

Description The software is susceptible to Incorrect Access Control. The mydetailsstudent.php endpoint allows unauthorized access to student details. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without proper identity or permission validation. This enables an attacker to enumerate and retrieve sensitive student details by manipulating the email value in the request URL, resulting in information disclosure.

Recommendations Ensure proper validation of user identity and permissions before accessing or disclosing student information through the mydetailsstudent.php endpoint. Restrict access to the myds GET parameter to authorized users only.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-50870

Affected Products

Institute-Of-Current-Students

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-50870 · Security Note
• https://cwe.mitre.org/data/definitions/284.html · Note
• https://twitter.com/CVEnew/status/1951331842382049317 · Twitter Post
• https://gist.github.com/b0mk35h/c4d47b5c4aacecdc8e6c4b02b40ce302 · Note