CVE-2025-60306
Published: 10 October 2025
Summary
CVE-2025-60306 is a critical-severity Improper Access Control (CWE-284) vulnerability in Code-Projects Simple Car Rental System. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33745
Vulnerability details
code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The permission bypass vulnerability allows low-privilege users to forge high-privilege sessions, directly enabling exploitation for privilege escalation (T1068) and forging web credentials such as session tokens or cookies (T1606).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.
Training covers access control policies and the consequences of improper access grants or usage by users.
Security training teaches access control policies and enforcement, reducing improper access control implementations.
Provides capability to review session content, directly detecting violations of access control.
System audit review detects violations of access controls by identifying unauthorized access attempts.
Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.
Requiring formal approval, documented controls, and responsibilities for inter-system exchanges directly enforces proper access control between systems.
Penetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses.