CVE-2025-25777

{"id": "CVE-2025-25777", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.5}]}, "published": "2025-04-24T21:15:23.933", "references": [{"url": "https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/", "source": "cve@mitre.org"}, {"url": "https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25777", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks."}, {"lang": "es", "value": "La Referencia Directa a Objetos (IDOR) insegura en Codeastro Bus Ticket Booking System v1.0 permite el acceso no autorizado a los perfiles de usuario. Al manipular el ID de usuario en la URL, un atacante puede acceder al perfil de otro usuario sin la debida autenticaci\u00f3n ni verificaci\u00f3n de autorizaci\u00f3n."}], "lastModified": "2025-04-29T13:52:28.490", "sourceIdentifier": "cve@mitre.org"}