PT-2025-3987 · Unknown · Campcodes School Management

Khukuririmal · Published 2025-01-22 · Updated 2026-01-12 · CVE-2025-0625

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The CampCodes School Management Software version 1.0 has a security issue in its Attachment Handler component, allowing for improper control of resource identifiers. This can be exploited remotely with a relatively high complexity of attack and is considered difficult to exploit. An exploit has been publicly disclosed and can be used. The vulnerable version is 1.0. More information about the exploit can be found at https://t.co/nzgfDXsBQu or https://t.co/pj1cwN7VVX. #CampCodes #SchoolManagementSoftware #AttachmentHandler #RemoteExploit #ImproperControl #ResourceIdentifiers #ExploitDisclosed #SchoolSoftwareSecurity

Exploit

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2025-0625

Affected Products

Campcodes School Management

References · 13

• 🔥 https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Insecure%20Direct%20Object%20Reference%20(IDOR)%20-%20All%20Student%20Homework%20Downloadable.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0625 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0625 · Vendor Advisory
• https://t.me/cvenotify/108171 · Telegram Post
• https://t.me/CSIRT_italia/3039 · Telegram Post
• https://vuldb.com/?id.292737 · Note
• https://vuldb.com/?ctiid.292737 · Note
• https://reddit.com/r/u_MotasemHa/comments/1qaoz3s/a_critical_router_security_risk_in_2026_what · Reddit Post
• https://twitter.com/VulmonFeeds/status/1881946527276359830 · Twitter Post
• https://vuldb.com/?submit.484917 · Note
• https://campcodes.com · Note
• https://twitter.com/CVEnew/status/1881933286424875401 · Twitter Post
• https://t.me/cvedetector/16069 · Telegram Post