{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-6329","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-06-19T10:10:43.329Z","datePublished":"2025-06-20T09:31:07.446Z","dateUpdated":"2025-06-20T13:51:04.739Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-06-20T09:31:07.446Z"},"title":"ScriptAndTools Real Estate Management System User Delete userdelete.php authorization","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-639","lang":"en","description":"Authorization Bypass"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-285","lang":"en","description":"Improper Authorization"}]}],"affected":[{"vendor":"ScriptAndTools","product":"Real Estate Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Delete Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Eine Schwachstelle wurde in ScriptAndTools Real Estate Management System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei userdelete.php der Komponente User Delete Handler. Dank Manipulation des Arguments ID mit unbekannten Daten kann eine authorization bypass-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2025-06-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-06-19T00:00:00.000Z","lang":"en","value":"Exploit disclosed"},{"time":"2025-06-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-06-19T12:52:25.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Maloy Roy Orko","type":"finder"},{"lang":"en","value":"MaloyRoyOrko (VulDB User)","type":"reporter"},{"lang":"en","value":"MaloyRoyOrko (VulDB User)","type":"analyst"}],"references":[{"url":"https://vuldb.com/?id.313325","name":"VDB-313325 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.313325","name":"VDB-313325 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.596472","name":"Submit #596472 | Script And Tools Real-Estate-Management-System 1.0 Insecure Direct Object Reference (IDOR)","tags":["third-party-advisory"]},{"url":"https://www.websecurityinsights.my.id/2025/06/script-and-tools-real-estate-management.html","tags":["exploit"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-20T13:50:43.917103Z","id":"CVE-2025-6329","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-06-20T13:51:04.739Z"}}]}}