PT-2025-45577 · Yungifez · Skuul School Management System

Zeeshan Khan · Published 2025-11-09 · Updated 2025-12-11 · CVE-2025-12918

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions yungifez Skuul School Management System versions up to 2.6.5

Description A security flaw exists in yungifez Skuul School Management System. Manipulation of the invoice id argument within an unknown function of the /dashboard/fees/fee-invoices/ file, part of the View Fee Invoice component, leads to improper control of resource identifiers. Remote exploitation is possible, and the exploit has been publicly released. The complexity of the attack is considered high, and exploitability is difficult. The vendor was contacted but did not respond.

Recommendations Versions prior to 2.6.5 should be used.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2025-12918

GHSA-FQQ7-H225-8W6H

Affected Products

Skuul School Management System

References · 13

• 🔥 https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041#steps-to-reproduce · Exploit
• 🔥 https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041 · Exploit
• 🔥 https://vuldb.com/?submit.680686 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12918 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12918 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fqq7-h225-8w6h · Vendor Advisory
• https://github.com/yungifez/skuul · Note
• https://vuldb.com/?id.331636 · Note
• https://vuldb.com/?ctiid.331636 · Note
• https://twitter.com/CVEnew/status/1987434474049503520 · Twitter Post
• https://t.me/cveNotify/145526 · Telegram Post
• https://t.me/CVEtracker/36875 · Telegram Post
• https://t.me/cveNotify/142223 · Telegram Post