Listen to this Post
How the mentioned CVE works:
The CVE-2025-65647 vulnerability is an Insecure Direct Object Reference (IDOR) in the Track order function of PHPGURUKUL Online Shopping Portal version 2.1. The application uses the ‘oid’ parameter in HTTP requests to fetch order details from the database without enforcing access controls. Specifically, when a user accesses the track order feature, the application retrieves order information based on the user-supplied ‘oid’ value but fails to verify if the user is authorized to view that particular order. This allows attackers to manipulate the ‘oid’ parameter by changing it to other values, such as incremental numbers, to access orders belonging to other users. The vulnerability likely occurs in server-side scripts like track_order.php, where the ‘oid’ is directly used in SQL queries without session-based validation. As a result, unauthorized users can disclose sensitive information, including customer names, addresses, order contents, and payment details, simply by modifying the parameter in GET or POST requests. The issue is exacerbated if the track order function is publicly accessible, enabling brute-force attacks to enumerate sequential order IDs and mass leak data.
Platform: PHPGURUKUL Online Shopping
Version: 2.1
Vulnerability: IDOR
Severity: Medium
Date: 11/25/2025
Prediction: Expected 2025-12-31
What Undercode Say:
Analytics:
curl “http://target/track_order.php?oid=1001”
for oid in {1000..1100}; do wget -q -O – “http://target/track_order.php?oid=$oid” | grep “customer”; done
sqlmap -u “http://target/track_order.php?oid=1” –risk=3 –level=5
how Exploit:
Intercept track request.
Modify oid parameter.
Brute-force sequential oids.
Extract sensitive data.
Protection from this CVE:
Implement access controls.
Use session validation.
Apply indirect references.
Rate limit requests.
Impact:
Information disclosure.
Privacy violation.
Data breach risk.
Compliance violations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
