Listen to this Post
The vulnerability is an authorization bypass in the EduplusCampus Student Payment API endpoint /student/get-receipt. Authenticated users, such as students, can send a normal HTTP GET request to this endpoint with a parameter like `rec_no=1001` to retrieve their own payment receipt. The core flaw is that the application fails to perform an access control check to verify the user’s authorization for the requested object. It trusts the user-supplied `rec_no` parameter as a direct reference to a database record without validating if the record belongs to the current user. An attacker can exploit this by simply incrementing or decrementing the `rec_no` value (e.g., to `1000` or 1002). The server processes this modified request and returns the sensitive personal and financial records associated with that other receipt number, leading to unauthorized data disclosure. This is a classic Insecure Direct Object Reference (IDOR) issue classified under CWE-639: Authorization Bypass Through User-Controlled Key.
dailycve form
Platform: EduplusCampus
Version: 3.0.1
Vulnerability: IDOR
Severity: MEDIUM
date: 2025-12-04
Prediction: 2025-12-29
What Undercode Say:
Reconnaissance and endpoint discovery
curl -s "https://target.edu/campus/api/" | grep -i "receipt|payment"
Testing for IDOR by parameter manipulation
curl -k -H "Authorization: Bearer [bash]" "https://target.edu/student/get-receipt?rec_no=1001"
curl -k -H "Authorization: Bearer [bash]" "https://target.edu/student/get-receipt?rec_no=1002"
Automated testing loop
for i in {1000..1010}; do
curl -k -H "Authorization: Bearer [bash]" "https://target.edu/student/get-receipt?rec_no=$i" -o receipt_$i.json
done
How Exploit:
Manipulate `rec_no` parameter.
Access unauthorized financial records.
No complex tools required.
Protection from this CVE
Upgrade to patched version.
Implement access control checks.
Validate user authorization for records.
Impact:
Unauthorized data exposure.
Potential identity theft.
High confidentiality impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
