Detections
Analytics
CVE-2025-61148
medium
Description
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
References
https://medium.com/@Charon19d/how-i-hacked-all-universities-in-my-city-d6b8e320455c
https://github.com/sharma19d/CVE-2025-61148
https://drive.google.com/file/d/1BRZRurbl7TY6KU4uaelAUn7L9Cn6XfjC/view?usp=sharing