CVE-2025-11151: CityPLus Information Disclosure Flaw

CVE-2025-11151 Overview

CVE-2025-11151 is an information disclosure vulnerability affecting Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus before version V24.29500.1.0. The flaw allows remote, unauthenticated attackers to detect unpublicized web pages, exposing sensitive system information to unauthorized actors. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The issue was published to the National Vulnerability Database (NVD) on October 21, 2025, and tracked by Turkey's National Cyber Incident Response Center (USOM).

Critical Impact

Remote unauthenticated attackers can enumerate hidden web pages in CityPLus, exposing sensitive system information without requiring user interaction or authentication.

Affected Products

• Beyaz Bilgisayar CityPLus versions before V24.29500.1.0

Discovery Timeline

• 2025-10-21 - CVE-2025-11151 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11151

Vulnerability Analysis

The vulnerability affects the CityPLus web application developed by Beyaz Bilgisayar. The application fails to enforce proper access controls on web pages intended to remain unpublicized. As a result, an attacker on the network can discover and access these resources without authentication. The flaw maps to [CWE-200] and represents a confidentiality exposure with limited integrity impact.

Successful exploitation reveals system information that should remain restricted to authorized users. This information can include internal application endpoints, configuration data, or administrative interfaces not linked from public navigation. Attackers often use such disclosures during reconnaissance to identify additional attack surface.

Root Cause

The root cause is insufficient authorization checks on hidden or undocumented web pages within the CityPLus application. Pages assumed to be hidden through obscurity remain reachable through direct request or enumeration. This violates the security principle of complete mediation, where every access must be checked against authorization policy.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests to the CityPLus application to enumerate non-public URLs. Tools such as directory brute-forcers or custom scripts can identify these endpoints. Refer to the USOM Security Notification for additional advisory details.

Detection Methods for CVE-2025-11151

Indicators of Compromise

• Anomalous HTTP GET requests to non-public CityPLus endpoints from external IP addresses
• Repeated 200 OK responses for URLs not present in standard application navigation logs
• Web server access logs showing directory or page enumeration patterns against the CityPLus host

Detection Strategies

• Review web server and application logs for sequential URL enumeration targeting CityPLus instances
• Deploy web application firewall (WAF) rules to flag high-frequency requests for unique URI paths from a single source
• Correlate reconnaissance behavior across the perimeter using SIEM analytics to identify probing campaigns

Monitoring Recommendations

• Establish baseline traffic patterns for CityPLus endpoints and alert on deviations
• Monitor outbound responses for sensitive data leakage tied to non-public pages
• Track requests for known administrative or diagnostic paths within the CityPLus application

How to Mitigate CVE-2025-11151

Immediate Actions Required

• Upgrade CityPLus to version V24.29500.1.0 or later as provided by Beyaz Bilgisayar
• Restrict network access to CityPLus management interfaces to trusted IP ranges
• Audit web server logs for prior enumeration attempts against affected endpoints

Patch Information

Upgrade CityPLus to version V24.29500.1.0 or later. The vendor advisory is referenced through the USOM Security Notification. Verify the upgrade by confirming the application version and testing that previously enumerable hidden pages now enforce authentication.

Workarounds

• Place CityPLus behind a reverse proxy that enforces authentication on all non-public paths
• Configure WAF rules to block access to URLs that should not be publicly reachable
• Apply network segmentation to limit exposure of the application to required user populations only