CVE-2025-6329 Details
Description
A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
An authorization bypass vulnerability has been identified in ScriptAndTools Real Estate Management System version 1.0. The issue arises in the User Delete Handler component, specifically within the userdelete.php file. By manipulating the 'id' parameter, it is possible to bypass authorization controls, allowing unauthorized users to delete accounts, including those of administrators. This vulnerability can be exploited remotely and has been publicly disclosed, with a proof-of-concept exploit available.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/?ctiid.313325 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.313325 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.596472 | [email protected] | Third Party AdvisoryVDB Entry |
| https://www.websecurityinsights.my.id/2025/06/script-and-tools-real-estate-management.html | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| scriptandtools real estate management system | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Jul 18, 2025 | Initial Analysis | [email protected] |
| Jun 20, 2025 | New CVE Received | [email protected] |