CVE-2025-61148

The EduplusCampus Student Portal (version 3.0.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the Student Payment API . Specifically, the /student/get-receipt endpoint fails to properly validate whether an authenticated user has the authority to access a requested rec...

📄 EduplusCampus 3.0.1 Insecure Direct Object Reference

A critical insecure direct object reference vulnerability was identified in the EduplusCampus student portal version 3.0.1. This vulnerability allows an authenticated user to access the sensitive personal and financial records of other students by modifying the recno parameter in the API request...