CVE-2025-6329 | THREATINT

Description

A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Eine Schwachstelle wurde in ScriptAndTools Real Estate Management System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei userdelete.php der Komponente User Delete Handler. Dank Manipulation des Arguments ID mit unbekannten Daten kann eine authorization bypass-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-06-19 | Published 2025-06-20 | Updated 2025-06-20 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

MEDIUM: 5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

5.5AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Authorization Bypass

Improper Authorization

Product status

1.0

affected

Timeline

2025-06-19:	Advisory disclosed
2025-06-19:	Exploit disclosed
2025-06-19:	VulDB entry created
2025-06-19:	VulDB entry last update

Credits

Maloy Roy Orko finder

MaloyRoyOrko (VulDB User) reporter

MaloyRoyOrko (VulDB User) analyst

References

vuldb.com/?id.313325 (VDB-313325 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization) vdb-entry technical-description

vuldb.com/?ctiid.313325 (VDB-313325 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.596472 (Submit #596472 | Script And Tools Real-Estate-Management-System 1.0 Insecure Direct Object Reference (IDOR)) third-party-advisory

www.websecurityinsights.my.id/...real-estate-management.html exploit

cve.org (CVE-2025-6329)

nvd.nist.gov (CVE-2025-6329)

Download JSON