PT-2025-9242 · Serosoft Solutions Pvt · Academia Student Information System (Sis) Eagler

Ralph El Khoury · Published 2025-03-03 · Updated 2025-12-12 · CVE-2025-25952

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118

Description The issue is related to an Insecure Direct Object References (IDOR) in the component "/getStudemtAllDetailsById?studentId=XX". This allows attackers to access sensitive user information via a crafted API request.

Recommendations For version 1.0.118, as a temporary workaround, consider restricting access to the "/getStudemtAllDetailsById?studentId=XX" API endpoint until a patch is available. Avoid using the studentId variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-25952

Affected Products

Academia Student Information System (Sis) Eagler

References · 9

• 🔥 https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25952 · Exploit
• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89639 · Exploit
• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25952 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25952 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25952 · Vendor Advisory
• https://t.me/cvedetector/19283 · Telegram Post
• https://t.me/cveNotify/145628 · Telegram Post
• https://t.me/cvenotify/113035 · Telegram Post
• https://twitter.com/CVEnew/status/1896399744374657175 · Twitter Post