CVE-2025-0875: PROLIZ OBS Auth Bypass Vulnerability

CVE-2025-0875 Overview

CVE-2025-0875 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System). The flaw allows Parameter Injection, enabling an authenticated user to manipulate request parameters and access data belonging to other users. All versions before v26.0328 are affected. The vulnerability requires network access and low-level privileges, but no user interaction. Successful exploitation results in unauthorized disclosure of confidential student records without impacting data integrity or availability.

Critical Impact
An authenticated attacker can tamper with user-controlled identifiers in OBS requests to read records belonging to other students, exposing personally identifiable information across the affected institution.

Affected Products

PROLIZ OBS (Student Affairs Information System) versions prior to v26.0328
Deployments of OBS used by Turkish higher-education institutions
Web-facing OBS portals exposing parameterized student record endpoints

Discovery Timeline

2025-09-22 - CVE-2025-0875 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0875

Vulnerability Analysis

The vulnerability resides in how the OBS application authorizes access to student record objects. OBS accepts identifiers supplied by the client, such as student numbers or record IDs, and uses them to retrieve data without verifying that the requesting session owns the referenced object. This design pattern is classically described as an Insecure Direct Object Reference. Because the identifier is user-controlled, an authenticated attacker can substitute another user's key and receive that user's data.

The advisory further characterizes the issue as Parameter Injection, indicating the attacker can influence backend query parameters through crafted input. Exploitation does not require elevated roles. A standard student account is sufficient to enumerate and read data associated with peers. The confidentiality impact is high, while integrity and availability are unaffected.

Root Cause

The root cause is missing server-side authorization checks that bind requested record identifiers to the authenticated session. OBS trusts the identifier value transmitted by the client and issues backend lookups against it directly. Without an ownership or role-based comparison, the application returns any record whose key matches the injected parameter.

Attack Vector

An attacker authenticates to OBS with valid credentials, intercepts a legitimate request that references a resource identifier, and modifies that identifier to a value belonging to a different user. The modified request is submitted over the network, and OBS returns the target record. See the USOM Notification TR-25-0282 and the Siber Güvenlik Notification TR-25-0282 for the coordinated advisory.

No public exploit code has been published for CVE-2025-0875 at the time of writing, and no working proof-of-concept is required to reproduce the technique against a vulnerable deployment.

Detection Methods for CVE-2025-0875

Indicators of Compromise

Repeated OBS requests from a single session that iterate sequential or high-cardinality identifier parameters such as studentId, ogrenciNo, or record keys.
Responses that return records whose owner does not match the authenticated session context in application logs.
Bursts of HTTP 200 responses containing distinct student personally identifiable information (PII) tied to one source IP.

Detection Strategies

Instrument OBS with per-request authorization logging that captures the authenticated user identifier and the requested resource identifier for correlation.
Alert when the ratio of accessed record identifiers to session identity exceeds a defined baseline within a short time window.
Review web application firewall (WAF) logs for parameter tampering patterns targeting OBS endpoints that return student data.

Monitoring Recommendations

Forward OBS application and web-server logs to a centralized analytics pipeline for behavioral review of identifier access patterns.
Track first-time access relationships between a user session and previously unseen record identifiers.
Monitor authentication events and correlate them with anomalous read volumes to surface potential enumeration activity.

How to Mitigate CVE-2025-0875

Immediate Actions Required

Upgrade PROLIZ OBS to version v26.0328 or later, which contains the vendor fix for the authorization bypass.
Rotate session tokens and force reauthentication for all OBS users following the upgrade.
Audit application logs for evidence of parameter tampering against student record endpoints prior to patch deployment.

Patch Information

PROLIZ addresses the vulnerability in OBS v26.0328. Institutions running earlier releases must coordinate with the vendor to obtain and deploy the patched build. Consult the USOM Notification TR-25-0282 for the official remediation reference.

Workarounds

Restrict OBS access to institutional networks or VPN endpoints to reduce the exposed attack surface until patching is complete.
Deploy WAF rules that enforce numeric bounds and format validation on identifier parameters submitted to OBS endpoints.
Enable enhanced application logging to capture identifier-to-session mismatches for retrospective analysis.

bash

# Example WAF rule concept to flag OBS identifier tampering
# (adapt syntax to your WAF platform)
SecRule REQUEST_URI "@contains /obs/" \
  "chain,phase:2,deny,status:403,id:1000875,\
   msg:'CVE-2025-0875 - OBS identifier tampering suspected'"
  SecRule ARGS:studentId "!@rx ^[0-9]{1,10}$"