What is the CVSS score of CVE-2025-65594?

CVE-2025-65594 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenSIS are affected by CVE-2025-65594?

OpenSIS versions 9.2 and earlier contain a broken access control flaw that allows authenticated low-privilege users (including students) to modify other users' records without authorization.

Is there a public PoC exploit available for CVE-2025-65594?

Yes, a public proof-of-concept exploit is available for CVE-2025-65594. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-65594?

24 hours: Audit Student.php access logs for unauthorized write operations; implement or verify role-based access controls preventing student accounts from modifying peer records. 7 days: Deploy Web Application Firewall (WAF) rules blocking database writes to Student.php from low-privilege sessions; disable Student.php modification capabilities for non-administrative accounts if operationally feasible. 30 days: Verify OpenSIS vendor patch timeline and commit to upgrade plan; conduct comprehensive audit of all student record modifications by low-privilege accounts dating back 90 days to identify unauthorized changes.

OpenSIS CVE-2025-65594

HIGH

Improper Access Control (CWE-284)

2025-12-09 cve@mitre.org

Authentication Bypass PHP Opensis

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable web endpoint (AV:N/AC:L) needs a low-privilege authenticated account (PR:L); description states write-only cross-user impact, so I:H but C:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:17 vuln.today

DescriptionNVD

OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.

AnalysisAI

Broken access control in OpenSIS 9.2 and earlier lets an authenticated low-privilege user (e.g. a student account) issue unauthorized database writes against other users' records via Student.php, enabling horizontal privilege escalation and tampering with data they should not control. Publicly available exploit code exists for this issue, though it is not listed in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no confirmed widespread exploitation yet.

Technical ContextAI

OpenSIS (os4ed:opensis) is a PHP-based open-source Student Information System used by schools to manage student, staff, scheduling, and grade data. The root cause is CWE-284 (Improper Access Control): the Student.php endpoint performs write operations without verifying that the requesting session is authorized to act on the targeted user's record. In multi-tenant education platforms, object-level authorization must be enforced per record; here the absence of that check allows any logged-in principal to reference and mutate arbitrary users' data, a classic IDOR-style authorization failure at the object level.

RemediationAI

No vendor-released patch identified at time of analysis, so upgrade to the vendor's fixed release once OS4ED publishes it and monitor the OS4ED OpenSIS project for an update superseding 9.2. As compensating controls in the interim: restrict OpenSIS access to trusted networks or a VPN rather than exposing it to the public internet (trade-off: reduces remote convenience for staff and students); enforce least-privilege on low-tier accounts and audit database write activity against Student.php for cross-user record modification; and if feasible add a WAF or web-server access rule limiting requests to the Student.php write paths (trade-off: may break legitimate self-service edits and requires tuning to avoid false positives). Reference the POC at https://gitlab.com/tsuretettee/cve-2025-65594 to validate whether your instance is affected.