CVE-2025-508.md

Author: Pronay Biswas LinkedIn

CVE-2025-50870 – Broken Access Control

Institute-of-Current-Students is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details, leading to information disclosure.

---

Affected Component

• File: mydetailsstudent.php
• Endpoint: http://127.0.0.1/Institute-of-Current-Students/mydetailsstudent.php

---

Attack Vectors
To exploit the vulnerability, an attacker only needs to modify the myds GET parameter to another student's email address (e.g., myds=victim@example.com). No authentication or authorization checks are enforced on the backend to verify that the requesting user is authorized to view the details of the target student. This results in a Broken Access Control vulnerability.

---

Additional Information
Impact:

• Unauthorized access to other students' personal information
• Privacy violation
• Potential identity theft or profiling
• Non-compliance with data protection regulations

---

Affected Product Code Base
Institute of Current-Students PHP Project

---

Reference
https://cwe.mitre.org/data/definitions/284.html