CVE-2025-25948

CriticalPublic PoC

Published: 03 March 2025

Published

03 March 2025

Modified

29 January 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0258 85.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25948 is a critical-severity Improper Access Control (CWE-284) vulnerability in Academiaerp Student Information System. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 enforces approved authorizations for access to system resources, directly preventing unauthenticated exploitation of the /rest/staffResource/create endpoint for account creation and modification.

AC-2 Account Management good match

prevent

AC-2 requires management of system accounts including creation, modification, and removal, mitigating unauthorized changes to user and administrator accounts.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

AC-14 mandates explicit authorization for actions without identification or authentication, addressing the vulnerability that permits unauthenticated account management operations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1136 Create Account Persistence

Adversaries may create an account to maintain access to victim systems.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote exploitation of public-facing web app (T1190) to create/modify privileged accounts (T1136).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.

Deeper analysisAI

CVE-2025-25948 is an incorrect access control vulnerability in the /rest/staffResource/create component of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118. Published on 2025-03-03, it stems from CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity with no availability disruption.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows attackers to create and modify user accounts, including Administrator accounts, potentially granting full unauthorized access to the system and enabling further compromise of sensitive student information or administrative functions.

References point to GitHub repositories containing vulnerability research, including proof-of-concept details at https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25948, https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637, and https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25948. No official vendor advisories or patches are detailed in available information.