CVE-2025-1885
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
Lifecycle Timeline
2Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forceful Browsing.This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
Restajet Online Food Delivery System allows authenticated users to redirect victims to untrusted external sites through an unvalidated URL redirection mechanism, enabling phishing attacks and forceful browsing. The vulnerability affects all versions through 19122025 and has a moderate CVSS score of 5.4 with low exploitation probability (EPSS 0.04%, 12th percentile), indicating limited real-world attack likelihood despite the functional impact. The vendor has not responded to early disclosure attempts by the Turkish national CERT, leaving no official patch available.
Technical Context
This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site), a client-side control mechanism flaw where user-supplied input is used to construct redirect URLs without proper validation or whitelisting. The affected product is Restajet Online Food Delivery System (CPE: cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*), which implements web-based food delivery functionality. The attack vector is network-based and requires low attack complexity, but mandates authenticated user privileges (PR:L per CVSS vector), meaning a logged-in user or attacker with valid credentials can craft malicious redirect parameters. The vulnerability allows scope changes (S:C), meaning the impact can cross security boundaries in the application context, affecting other users or systems downstream of the redirect.
Affected Products
Restajet Online Food Delivery System through version 19122025 is affected, as confirmed by CPE cpe:2.3:a:restajet:online_food_delivery_system:-:*:*:*:*:*:*:*. The vulnerability was reported to the vendor (Restajet Information Technologies Inc.) by the Turkish national CERT ([email protected]) via disclosure notification TR-25-0469, and detailed technical information is available on VulnDB (vuldb.com/?id.337606). No specific patched version has been released; the vendor has not responded to early disclosure attempts.
Remediation
No vendor-released patch has been identified at time of analysis. Organizations should contact Restajet Information Technologies Inc. directly to request a security update and establish a timeline for patching. As a temporary mitigation, implement strict URL validation and whitelisting on all redirect parameters, enforce a Content Security Policy (CSP) with frame-ancestors and redirect-uri directives to restrict outbound redirects, and consider implementing a redirect interstitial page that warns users before following external links. Additionally, audit application logs for suspicious redirect parameter usage and restrict authenticated user accounts to trusted networks if feasible until a patch is available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today