CVE-2025-1607

CWE-285 CWE-639 — Insecure Direct Object Reference CWE-532 — Log File Information Exposure6 documents4 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 73.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sourcecodester Best Employee Management System Mayurik Best Employee Management System

Timeline

PublishedFeb 24

Description

A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salary_slip.php. The manipulation of the argument id leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5sourcecodester/best_employee_management_system1.0

▶NVDmayurik/best_employee_management_system1.0

🔴Vulnerability Details

CVEList

SourceCodester Best Employee Management System salary_slip.php authorization↗2025-02-24

▶

GHSA

GHSA-f67q-rx5w-v4hr: A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1↗2025-02-24

▶

📋Vendor Advisories

Microsoft

Windows Kernel Memory Information Disclosure Vulnerability↗2025-01-14

▶