EUVD-2025-17648
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/selection.asp.
Analysis
CVE-2025-40661 is an Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS that allows unauthenticated attackers to bypass authentication and access the private administrative area by manipulating the 'option' parameter (values 0, 1, or 2) in the /administer/selectionnode/selection.asp endpoint. The vulnerability has a CVSS score of 7.5 (High) with high confidentiality impact, indicating potential exposure of sensitive administrative data. No KEV status, EPSS score, or confirmed POC availability was provided in the source data, limiting definitive assessment of active exploitation.
Technical Context
DM Corporative CMS is a web-based content management system that implements role-based access control through the /administer/selectionnode/selection.asp resource. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of authorization flaws where the application fails to properly validate that the user has permission to access a specific object or function based on user-supplied identifiers. The 'option' parameter (0, 1, 2) likely represents different administrative selection nodes or configuration states; the application trusts this parameter value without verifying the requesting user's authentication status or authorization level. This is a parameter-based IDOR—the attacker modifies a numeric parameter to enumerate and access restricted administrative resources without proper session validation or access control checks.
Affected Products
DM Corporative CMS (specific version range not provided in available data). The vulnerability is confirmed present in the /administer/selectionnode/selection.asp resource. CPE identifier would be of form cpe:2.3:a:dm_corporative:*:*:*:*:*:*:*:*:* or similar; exact vendor namespace and affected version numbers are not detailed in the source material. Organizations running DM Corporative CMS should cross-reference their installation version against vendor advisories. No specific patch version or vendor advisory URL was provided in the source data.
Remediation
1. Immediate: Restrict network access to the /administer/selectionnode/selection.asp endpoint using WAF rules or web server configuration (IP whitelisting, require VPN). 2. Implement proper authentication and session validation before any parameter processing—verify user identity and authorization level server-side, independent of parameter values. 3. Apply authorization checks per OWASP IDOR prevention guidelines: validate that the authenticated user has explicit permission to access the requested object (option node) before returning data. 4. Contact DM Corporative vendor for security patch/advisory; apply patch when available to the /administer/selectionnode/selection.asp handler. 5. Audit logs for evidence of unauthorized access to /administer/selectionnode/selection.asp with option parameters 0, 1, 2. 6. Long-term: implement consistent server-side access control framework across all administrative endpoints, perform security code review of CMS authorization logic.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today