LearnHouse CVE-2025-12270

The attacker must possess valid authentication credentials to the LearnHouse platform (PR:L in CVSS vector); unauthenticated access is not possible. The vulnerability requires knowledge or enumeration of valid assignment_id and task_id parameters within the application-these are typically small integers or predictable identifiers. The Student Assignment Submission Handler component must be enabled and deployed; if the assignment submission feature is disabled administratively, the endpoint is unexploited. File submissions must exist for the target assignments; if no students have submitted files to a given task, there is no data to exfiltrate. The endpoint must be internet-accessible via network (AV:N, AC:L confirm no special network configuration); deployment behind a WAF with resource ID validation would block enumeration. No special UI interaction is required (UI:N); direct HTTP API calls are sufficient.

CVSS 2.1 (CVSSv4.0) with AV:N/AC:L/PR:L indicates low severity: network-accessible but requires authenticated access, with low attack complexity and low confidentiality impact (VC:L). The EPSS score of 0.04% (13th percentile) suggests minimal real-world exploitation probability despite public POC, contradicting the CWE-99 disclosure pattern which typically sees higher adoption. This discrepancy suggests either: (1) the POC is recent and has not yet driven widespread exploitation, (2) attackers prefer targeted reconnaissance over mass exploitation, or (3) practical barriers (API rate limiting, detection mechanisms, or required knowledge of valid assignment/task IDs) limit real-world abuse. The authentication requirement (PR:L) significantly reduces risk compared to unauthenticated variants. No KEV listing indicates CISA has not confirmed active exploitation in the wild. For risk prioritization, this is a low-urgency patch despite public POC-appropriate for standard patching cycles rather than emergency response.

An authenticated LearnHouse student or lower-privileged user identifies the assignment submission API endpoint structure through documentation or reverse engineering. Using the publicly available POC (https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b), they systematically iterate through assignment_id and task_id integers (e.g., /api/v1/assignments/1/tasks/1/sub_file, /api/v1/assignments/1/tasks/2/sub_file, etc.) to download submitted assignment files from other students, retrieving homework solutions, essays, or code repositories without authorization.