CVE-2025-11080: wisdom-education Auth Bypass Vulnerability

CVE-2025-11080 Overview

CVE-2025-11080 is an improper authorization vulnerability [CWE-266] in the zhuimengshaonian wisdom-education platform through version 1.0.4. The flaw resides in the selectStudentExamInfoList function within src/main/java/com/education/api/controller/student/ExamInfoController.java. An authenticated attacker can manipulate the subjectId parameter to access exam information belonging to other students, resulting in horizontal privilege escalation. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact

Authenticated remote attackers can bypass authorization checks on the student exam information endpoint, exposing confidential academic records belonging to other users.

Affected Products

• zhuimengshaonian wisdom-education versions up to and including 1.0.4
• Component: ExamInfoController.java (selectStudentExamInfoList function)
• Vulnerable parameter: subjectId

Discovery Timeline

• 2025-09-27 - CVE-2025-11080 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-11080

Vulnerability Analysis

The vulnerability is a horizontal privilege escalation issue in a Java-based web controller handling student exam data. The selectStudentExamInfoList function accepts a subjectId parameter from the client without validating that the requesting user is authorized to view records associated with that identifier. By substituting another user's subjectId, an authenticated attacker retrieves exam information outside their own authorization scope.

Improper authorization vulnerabilities of this class [CWE-266] result from relying on client-supplied identifiers for access decisions. The server trusts the parameter rather than enforcing ownership or role checks against the authenticated session context.

The exploit has been publicly disclosed through a GitHub proof-of-concept, which lowers the barrier for opportunistic exploitation against internet-exposed instances. Attack complexity is low and no user interaction is required.

Root Cause

The root cause is missing authorization enforcement in the server-side controller. The application derives the target record set from the user-controlled subjectId parameter instead of binding queries to the authenticated principal. No ownership verification occurs between the session identity and the requested resource.

Attack Vector

Exploitation is network-based and requires only low-privileged authenticated access. An attacker logs into the wisdom-education platform with any valid student account, intercepts a legitimate request to the exam information endpoint, and modifies the subjectId value to target another user's data. The server returns the requested records without rejecting the request.

Refer to the published GitHub vulnerability reproduction documentation for the specific HTTP request structure used to trigger the flaw.

Detection Methods for CVE-2025-11080

Indicators of Compromise

• Access log entries showing a single authenticated session issuing requests with sequentially or randomly varied subjectId values
• Repeated HTTP 200 responses to selectStudentExamInfoList from accounts that should not have cross-student visibility
• Unusual volumes of exam information queries originating from a single student account

Detection Strategies

• Instrument the ExamInfoController endpoint to log the authenticated principal alongside each requested subjectId and alert on mismatches
• Deploy web application firewall rules to flag parameter tampering patterns targeting the student exam endpoints
• Correlate authentication telemetry with API access logs to identify horizontal access anomalies across student accounts

Monitoring Recommendations

• Monitor API request rates per authenticated session for enumeration behavior against the subjectId parameter
• Review database query logs for queries returning rows outside the authenticated user's expected scope
• Baseline normal student query behavior and alert on deviations such as bursts of unique subjectId values

How to Mitigate CVE-2025-11080

Immediate Actions Required

• Restrict external access to wisdom-education instances until a vendor patch is applied
• Audit application access logs for prior misuse of the selectStudentExamInfoList endpoint
• Implement a server-side authorization check that validates the authenticated user owns the requested subjectId before returning results

Patch Information

At the time of publication, no official vendor patch has been referenced in the CVE record. Monitor the zhuimengshaonian wisdom-education project and the VulDB entry for updates. Apply fixes immediately upon release.

Workarounds

• Add a server-side filter that derives the student identifier from the authenticated session rather than the request parameter
• Deploy a reverse proxy or API gateway rule that rejects requests where the subjectId does not match the session principal
• Reduce the exposure surface by placing the application behind VPN or SSO-restricted access until a code fix is deployed

# Example reverse proxy rule enforcing session-bound subjectId checks
# (nginx + Lua pseudo-configuration)
location /api/student/examInfoList {
    access_by_lua_block {
        local session_subject = ngx.var.cookie_subjectId
        local arg_subject = ngx.var.arg_subjectId
        if session_subject ~= arg_subject then
            ngx.exit(403)
        end
    }
    proxy_pass http://wisdom_education_backend;
}