CVE-2025-12288: IDOR in Pharmacy Management System v9.4

Critical Vulnerability Information Vulnerability Overview Type: Insecure Direct Object Reference (IDOR) / Access Control Bypass CVE ID: CVE-2025-12288 Product: Pharmacy Management System v9.4 Author: 4m3rr0r Vulnerability Details Affected URL: Vulnerable Parameter: identifier in the URL path Vulnerable Component: User profile management Vulnerability Type Access Control Bypass CVE ID: CWE-639: Bypassing Authorization via User-Controlled Key Severity Level: High CVSS Score: 8.8 (High) Root Cause The application uses predictable, sequential user IDs in the URL to retrieve and display user profile data. However, it fails to perform server-side authorization checks to verify whether the currently authenticated user has the necessary permissions to view or edit the profile associated with the requested ID. This allows any authenticated user to access other users’ profiles simply by manipulating the ID in the URL. Impact Sensitive Information Disclosure: Attackers can view personal and account information of any user on the platform, including administrators, by iterating through user IDs. Privilege Escalation: Low-privileged users can access data belonging to high-privileged administrators, leading to vertical privilege escalation. Account Takeover: The vulnerable endpoint also allows profile modifications (e.g., changing email or password), enabling this vulnerability to escalate into full account takeover for any user, including administrators. Massive User Data Exposure: Attackers can write a simple script to loop through all possible user IDs and collect personal information from the entire user database. Proof of Concept (PoC) A video demonstrating this vulnerability has been recorded and is available for viewing here. Steps: 1. Log in to the application with a non-administrator user account. For example, log in as “Account Head” with email . 2. Navigate to your own profile page, which will have a URL similar to: 3. In the browser’s address bar, change the last digit (user ID) from to , which is typically the default ID for the main administrator. The new URL becomes: 4. Press Enter. The application will display the administrator’s profile information, confirming the presence of the IDOR vulnerability. Recommended Remediation Implement Server-Side Authorization Checks: The most critical fix is to enforce access control on the server for every request. Backend code must verify that the logged-in user’s ID matches the requested ID, or that the logged-in user holds an administrator role, before displaying any user data.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-12288: IDOR in Pharmacy Management System v9.4

More from this source