PT-2025-9240 · Serosoft Solutions Pvt · Academia Student Information System (Sis) Eagler

Ralph El Khoury · Published 2025-03-03 · Updated 2025-12-12 · CVE-2025-25950

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118

Description The issue is related to incorrect access control in the component "/rest/staffResource/update" of the affected software, allowing unauthorized creation and modification of user accounts, including an Administrator account.

Recommendations For version 1.0.118, as a temporary workaround, consider restricting access to the "/rest/staffResource/update" API endpoint until a patch is available. Additionally, limit the ability to create and modify user accounts to authorized personnel only.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-25950

Affected Products

Academia Student Information System (Sis) Eagler

References · 12

• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89637 · Exploit
• 🔥 https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25950 · Exploit
• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25950 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25950 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25950 · Vendor Advisory
• https://t.me/cvenotify/113579 · Telegram Post
• https://t.me/cvedetector/19281 · Telegram Post
• https://twitter.com/cracbot/status/1897965564578119864 · Twitter Post
• https://twitter.com/cracbot/status/1898327948291400177 · Twitter Post
• https://t.me/cveNotify/145626 · Telegram Post
• https://twitter.com/CVEnew/status/1896399742508105925 · Twitter Post
• https://t.me/cvenotify/113033 · Telegram Post