Описание
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- Product
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:edupluscampus:edupluscampus:3.0.1:*:*:*:*:*:*:*
EPSS
Процентиль: 10%
0.00034
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 6.5
github
2 месяца назад
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
EPSS
Процентиль: 10%
0.00034
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-639