CVE-2025-0849
Published: 30 January 2025
Summary
CVE-2025-0849 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Campcodes School Management Software. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to the Staff Handler /edit-staff/ function, directly preventing low-privileged users from performing unauthorized staff edits.
Implements least privilege to restrict teacher accounts from accessing or modifying super admin staff data via the vulnerable endpoint.
Enforces separation of duties to mitigate incorrect privilege assignments that enable role escalations like teacher to super admin in the Staff Handler.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The IDOR vulnerability enables low-privileged teacher accounts to discover sensitive super admin details (T1087.001, T1213.004 in CRM software) and perform unauthorized updates to admin account data (T1098), facilitating privilege escalation via improper authorization exploitation (T1068).
NVD Description
A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0849 is a critical improper authorization vulnerability in CampCodes School Management Software version 1.0. The issue affects an unknown function within the /edit-staff/ file of the Staff Handler component. Published on 2025-01-30T02:15:25.783, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWEs 266, 285, and NVD-CWE-noinfo.
A low-privileged remote attacker can exploit this vulnerability with low complexity and no user interaction. Exploitation enables improper authorization, allowing limited impacts on confidentiality, integrity, and availability, such as unauthorized data exposure and updates.
Advisories detail the issue on VulDB (ctiid.294012, id.294012, submit.487618), with a GitHub PDF describing sensitive super admin data exposure and unauthorized updates via IDOR from teacher to super admin roles. The vendor site is campcodes.com. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)