📄 Classroomio LMS 0.1.13 Insecure Direct Object Reference_PACKETSTORM:212008

{
    "lastseen": "2025-11-25T19:07:04",
    "description": "Classroomio LMS version 0.1.13 suffers from multiple insecure direct object reference vulnerabilities...",
    "published": "2025-11-25T00:00:00",
    "modified": "2025-11-25T00:00:00",
    "type": "packetstorm",
    "title": "\ud83d\udcc4 Classroomio LMS 0.1.13 Insecure Direct Object Reference",
    "source": "",
    "references": "",
    "id": "PACKETSTORM:212008",
    "bulletinFamily": "exploit",
    "cwe": null,
    "cvelist": [
        "CVE-2025-65670",
        "CVE-2025-65672"
    ],
    "sourceData": "# CVE-2025-65670\n    An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.Discovered by - Rivek Raj Tamang (RivuDon), Sikkim, India.\n    \n    **Affected Product: ClassroomIO**\n    * Affected Version: 0.1.13\n    * **Discovered by: Rivek Raj Tamang (RivuDon), Sikkim, India**\n    \n    ## Vulnerability Details\n    Insecure Direct Object Reference / Broken Access Control\n    \n    # Summary\n    This vulnerability allows a student-level user to momentarily access privileged admin-only endpoints by directly manipulating course IDs in the URL. Due to missing authorization checks and improper access validation, sensitive course analytics, attendance records, submissions, people lists, and marks become exposed before the system reverts to enforcing restrictions. This brief but critical information disclosure constitutes an IDOR-based Broken Access Control issue and can lead to leakage of sensitive administrative and student data.\n    \n    ## Steps to Reproduce\n    Login as Admin\n    \n    1. Create and publish a course with enrolled students.\n    \n    2. Access admin endpoints for the course e.g..\n    \n    courses/<course-ID>/analytics, courses/<course-ID>/attendance, courses/<course-ID>/submissions, courses/<course-ID>/people, courses/<course-ID>/marks, \n    \n    3. Admin can view expected data.\n    \n    Login as Student\n    \n    4. Join the course via Explore\n    \n    5. Verify Students cannot see admin in the UI\n    \n    6. Find the course ID (e.g. by inspecting course lessons URL).\n    \n    7. Manually access the admin endpoints by crafting URLs such as:\n    \n    courses/<course-ID>/analytics, courses/<course-ID>/attendance, courses/<course-ID>/submissions, courses/<course-ID>/people, courses/<course-ID>/marks, \n    \n    8. The system responds with data meant only for Admin/Teacher roles momentarily, leaking sensitive information before reverting to restricting access.\n    \n    \n    \n    # Acknowledgement \n    \n    This vulnerability was discovered and responsibly reported by:\n    \n    **Rivek Raj Tamang (RivuDon) from Sikkim, India** \n    \n    https://www.linkedin.com/in/rivektamang/\n    \n    https://rivudon.medium.com/\n    \n    \n    -------------------\n    \n    # CVE-2025-65672\n    Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.\n    \n    **Affected Product: ClassroomIO**\n    * Affected Version: 0.1.13\n    * **Discovered by: Rivek Raj Tamang (RivuDon), Sikkim, India**\n    \n    ## Vulnerability Details\n    Insecure Direct Object Reference (IDOR) / Broken Access Control\n    \n    # Summary\n    ClassroomIO version 0.1.13 contains an IDOR vulnerability that allows a student (non-privileged user) to access restricted Course Settings, specifically the Share and Invite management interfaces.\n    This flaw arises due to improper authorization checks on sensitive endpoints, enabling privilege escalation and unauthorized course manipulation.\n    \n    ## Steps to Reproduce\n    1. Create Course (Admin)\n       \n    2. Log in as an Admin and create/publish a new course.\n    \n    3. Student View\n        Log in as a Student.\n    \n        Navigate to the course using the Explore page.\n    \n        Note the course ID in the URL.\n    \n    5. Access Restricted Pages Directly\n        Replace {course-id} with a valid course ID and visit:\n    \n        /courses/{course-id}/settings#share\n    \n        /courses/{course-id}/people?add=true\n    \n    7. Observe the Impact\n        The student is able to access:\n    \n        Share Settings\n    \n        Invite/People Management Panel\n    \n        These actions are meant only for the course admin, but due to missing access checks, the student gains unauthorized control.\n    \n    # Acknowledgement \n    \n    This vulnerability was discovered and responsibly reported by:\n    \n    **Rivek Raj Tamang (RivuDon) from Sikkim, India** \n    \n    https://www.linkedin.com/in/rivektamang/\n    \n    https://rivudon.medium.com/",
    "sourceHref": "https://packetstorm.news/download/212008",
    "cvss": {
        "score": 0,
        "severity": "NONE",
        "vector": "NONE",
        "version": "NONE"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://packetstorm.news/files/id/212008/",
    "category_name": "Exploit",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}