PT-2025-9244 · Serosoft Solutions Pvt · Academia Student Information System (Sis) Eagler

Published 2025-03-03 · Updated 2025-03-08 · CVE-2025-27583

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118

Description The issue is related to incorrect access control in the component "/rest/staffResource/findAllUsersAcrossOrg" of the affected software, allowing unauthorized creation and modification of user accounts, including an Administrator account.

Recommendations For version 1.0.118, consider restricting access to the /rest/staffResource/findAllUsersAcrossOrg endpoint until a fix is available. Additionally, review and limit user account creation and modification privileges to authorized personnel only.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-27583

Affected Products

Academia Student Information System (Sis) Eagler

References · 9

• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27583 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27583 · Vendor Advisory
• https://twitter.com/CVEnew/status/1896399746358558823 · Twitter Post
• https://twitter.com/cracbot/status/1898327952963907914 · Twitter Post
• https://t.me/cvenotify/113037 · Telegram Post
• https://t.me/cvedetector/19275 · Telegram Post
• https://t.me/cvenotify/113581 · Telegram Post
• https://twitter.com/cracbot/status/1897965569502228885 · Twitter Post