Cyber Resilience

CVE-2025-25948

CriticalPublic PoC

Published: 03 March 2025

Published
03 March 2025
Modified
29 January 2026
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0321 87.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25948 is a critical-severity Improper Access Control (CWE-284) vulnerability in Academiaerp Student Information System. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).

Deeper analysis

CVE-2025-25948 is an incorrect access control vulnerability in the /rest/staffResource/create component of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118. The flaw, tracked under CWE-284, permits creation and modification of user accounts, including administrator accounts, and carries a CVSS 3.1 score of 9.1 reflecting network-accessible exploitation without authentication or user interaction.

Unauthenticated remote attackers can directly invoke the affected endpoint to provision or alter accounts with elevated privileges, thereby gaining administrative control over the SIS installation.

Public references consist of GitHub repositories maintained by security researchers that document the issue, with no vendor advisories or patch information provided. The associated EPSS score remains flat at 0.0321 with no material increase observed.

EU & UK References

Vulnerability details

Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1136 Create Account Persistence
Adversaries may create an account to maintain access to victim systems.
Why these techniques?

Direct unauthenticated remote exploitation of public-facing web app (T1190) to create/modify privileged accounts (T1136).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39339Shared CWE-284
CVE-2026-46839Shared CWE-284
CVE-2025-26010Shared CWE-284
CVE-2026-34291Shared CWE-284
CVE-2023-47539Shared CWE-284
CVE-2026-23899Shared CWE-284
CVE-2025-7016Shared CWE-284
CVE-2026-46822Shared CWE-284
CVE-2024-37566Shared CWE-284
CVE-2026-30689Shared CWE-284

Affected Assets

academiaerp
student information system
eagler-1.0.118

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

AC-3 enforces approved authorizations for access to system resources, directly preventing unauthenticated exploitation of the /rest/staffResource/create endpoint for account creation and modification.

prevent

AC-2 requires management of system accounts including creation, modification, and removal, mitigating unauthorized changes to user and administrator accounts.

prevent

AC-14 mandates explicit authorization for actions without identification or authentication, addressing the vulnerability that permits unauthenticated account management operations.

References