{"id":"CVE-2025-6329","state":"PUBLISHED","title":"ScriptAndTools Real Estate Management System User Delete userdelete.php authorization","description":"A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-06-20T09:31:07.446Z","updatedAt":"2025-06-20T13:51:04.739Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["ScriptAndTools Real Estate Management System"],"affected":[{"vendor":"ScriptAndTools","product":"Real Estate Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Delete Handler"]}],"references":["https://vuldb.com/?id.313325","https://vuldb.com/?ctiid.313325","https://vuldb.com/?submit.596472","https://www.websecurityinsights.my.id/2025/06/script-and-tools-real-estate-management.html"],"weaknesses":["CWE-639","CWE-285"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/6xxx/CVE-2025-6329.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-6329","state":"PUBLISHED","datePublished":"2025-06-20T09:31:07.446Z","dateUpdated":"2025-06-20T13:51:04.739Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-06-19T10:10:43.329Z"},"containers":{"cna":{"title":"ScriptAndTools Real Estate Management System User Delete userdelete.php authorization","descriptions":[{"lang":"en","value":"A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Eine Schwachstelle wurde in ScriptAndTools Real Estate Management System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei userdelete.php der Komponente User Delete Handler. Dank Manipulation des Arguments ID mit unbekannten Daten kann eine authorization bypass-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"ScriptAndTools","product":"Real Estate Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Delete Handler"]}],"references":[{"url":"https://vuldb.com/?id.313325","name":"VDB-313325 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.313325","name":"VDB-313325 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.596472","name":"Submit #596472 | Script And Tools Real-Estate-Management-System 1.0 Insecure Direct Object Reference (IDOR)","tags":["third-party-advisory"]},{"url":"https://www.websecurityinsights.my.id/2025/06/script-and-tools-real-estate-management.html","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","type":"CWE","lang":"en","description":"Authorization Bypass"}]},{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-06-20T09:31:07.446Z"},"timeline":[{"time":"2025-06-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-06-19T00:00:00.000Z","lang":"en","value":"Exploit disclosed"},{"time":"2025-06-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-06-19T12:52:25.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Maloy Roy Orko","type":"finder"},{"lang":"en","value":"MaloyRoyOrko (VulDB User)","type":"reporter"},{"lang":"en","value":"MaloyRoyOrko (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-20T13:50:43.917103Z","id":"CVE-2025-6329","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-20T13:51:04.739Z"}}]}}}