CVE-2025-25948
Published: 03 March 2025
Summary
CVE-2025-25948 is a critical-severity Improper Access Control (CWE-284) vulnerability in Academiaerp Student Information System. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).
Deeper analysis
CVE-2025-25948 is an incorrect access control vulnerability in the /rest/staffResource/create component of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118. The flaw, tracked under CWE-284, permits creation and modification of user accounts, including administrator accounts, and carries a CVSS 3.1 score of 9.1 reflecting network-accessible exploitation without authentication or user interaction.
Unauthenticated remote attackers can directly invoke the affected endpoint to provision or alter accounts with elevated privileges, thereby gaining administrative control over the SIS installation.
Public references consist of GitHub repositories maintained by security researchers that document the issue, with no vendor advisories or patch information provided. The associated EPSS score remains flat at 0.0321 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5835
Vulnerability details
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing web app (T1190) to create/modify privileged accounts (T1136).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly preventing unauthenticated exploitation of the /rest/staffResource/create endpoint for account creation and modification.
AC-2 requires management of system accounts including creation, modification, and removal, mitigating unauthorized changes to user and administrator accounts.
AC-14 mandates explicit authorization for actions without identification or authentication, addressing the vulnerability that permits unauthenticated account management operations.