CVE-2025-65670 PoC — ClassroomIO.com 安全漏洞

Description

An (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints. Discovered by - Rivek Raj Tamang (RivuDon), Sikkim, India.

介绍

# CVE-2025-65670
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.Discovered by - Rivek Raj Tamang (RivuDon), Sikkim, India.

**Affected Product: ClassroomIO**
* Affected Version: 0.1.13
* **Discovered by: Rivek Raj Tamang (RivuDon), Sikkim, India**

## Vulnerability Details
Insecure Direct Object Reference / Broken Access Control

# Summary
This vulnerability allows a student-level user to momentarily access privileged admin-only endpoints by directly manipulating course IDs in the URL. Due to missing authorization checks and improper access validation, sensitive course analytics, attendance records, submissions, people lists, and marks become exposed before the system reverts to enforcing restrictions. This brief but critical information disclosure constitutes an IDOR-based Broken Access Control issue and can lead to leakage of sensitive administrative and student data.

## Steps to Reproduce
Login as Admin

1. Create and publish a course with enrolled students.

2. Access admin endpoints for the course e.g..

courses/<course-ID>/analytics, courses/<course-ID>/attendance, courses/<course-ID>/submissions, courses/<course-ID>/people, courses/<course-ID>/marks, 

3. Admin can view expected data.

Login as Student

4. Join the course via Explore

5. Verify Students cannot see admin in the UI

6. Find the course ID (e.g. by inspecting course lessons URL).

7. Manually access the admin endpoints by crafting URLs such as:

courses/<course-ID>/analytics, courses/<course-ID>/attendance, courses/<course-ID>/submissions, courses/<course-ID>/people, courses/<course-ID>/marks, 

8. The system responds with data meant only for Admin/Teacher roles momentarily, leaking sensitive information before reverting to restricting access.



# Acknowledgement 

This vulnerability was discovered and responsibly reported by:

**Rivek Raj Tamang (RivuDon) from Sikkim, India** 

https://www.linkedin.com/in/rivektamang/

https://rivudon.medium.com/

文件快照

备注