PT-2025-48079 · Unknown · Phpgurukul Online Shopping Portal

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-65647

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPGURUKUL Online Shopping Portal version 2.1

Description An Insecure Direct Object Reference (IDOR) exists in the Track order function. This allows information disclosure through manipulation of the oid parameter. An IDOR occurs when an application provides direct access to objects based on user-supplied input. In this case, a user may be able to access order information that they are not authorized to view by modifying the oid parameter.

Recommendations Ensure proper authorization checks are implemented within the Track order function to verify that users only have access to their own order information. Validate the oid parameter to ensure it corresponds to a valid order associated with the authenticated user.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-65647

Affected Products

Phpgurukul Online Shopping Portal

References · 8

• 🔥 https://github.com/SachuuZ/CVE/tree/main/CVE-2025-65647 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65647 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65647 · Vendor Advisory
• https://twitter.com/CVEnew/status/1993407022528708967 · Twitter Post
• https://twitter.com/dailycve/status/1995529238082916687 · Twitter Post
• https://phpgurukul.com · Note
• https://t.me/cveNotify/144406 · Telegram Post
• https://t.me/CVEtracker/38220 · Telegram Post