Description (CNA)
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://drive.google.com/file/d/1BRZRurbl7TY6KU4uaelAUn7L9Cn6XfjC/view?usp=sharing
- https://medium.com/@Charon19d/how-i-hacked-all-universities-in-my-city-d6b8e320455c
- https://github.com/sharma19d/CVE-2025-61148
ADP enrichment
No English description supplied.
No references supplied.