CVE-2025-11321: Wisdom-Education Authorization Bypass Flaw

CVE-2025-11321 Overview

CVE-2025-11321 is an authorization bypass vulnerability affecting zhuimengshaonian wisdom-education versions up to 1.0.4. The flaw resides in the WrongBookController.java file located at src/main/java/com/education/api/controller/student/. Attackers can manipulate the subjectId parameter to bypass authorization checks and access data belonging to other users. The vulnerability is remotely exploitable and requires only low-privilege authentication. A public proof-of-concept has been published, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact

Authenticated remote attackers can bypass authorization controls in the wrong-answer book endpoint to access records tied to other students, resulting in confidentiality loss across tenant boundaries.

Affected Products

• zhuimengshaonian wisdom-education versions up to and including 1.0.4
• Deployments exposing the student WrongBookController API endpoint
• Any downstream forks reusing the vulnerable subjectId handler

Discovery Timeline

• 2025-10-06 - CVE-2025-11321 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11321

Vulnerability Analysis

The vulnerability is a horizontal authorization bypass classified under [CWE-285] Improper Authorization. The affected endpoint in WrongBookController.java accepts a client-supplied subjectId parameter and returns the corresponding wrong-answer records without validating that the parameter belongs to the requesting user's session context. An authenticated student can substitute another user's subjectId value and receive their private study data.

The attack requires network access to the application and a valid low-privilege account. No user interaction is needed, and complexity is low. Because a public exploit exists, threat actors can automate enumeration of subjectId values across an exposed instance.

Root Cause

The root cause is missing object-level access control on the WrongBookController handler. The controller trusts the subjectId request parameter as an authoritative reference to the target record rather than deriving ownership from the authenticated session. This is a textbook Insecure Direct Object Reference pattern, where the application resolves data by primary key without checking that the key belongs to the caller.

Attack Vector

An attacker authenticates with any valid student credentials, then issues requests to the wrong-answer book endpoint while iterating the subjectId parameter. Each response discloses another user's data. The exploit is confined to disclosure only; integrity and availability are not affected based on the vulnerability description. Public proof-of-concept material is available on the referenced GitHub CVE PoC Repository and the VulDB #327202 entry.

No verified code examples are available. See the linked references for step-by-step reproduction details.

Detection Methods for CVE-2025-11321

Indicators of Compromise

• Repeated requests to the wrong-answer book endpoint from a single authenticated session that iterate the subjectId parameter across sequential or randomized values.
• Application logs showing a single user identifier accessing records associated with many distinct subjectId values in short time windows.
• Anomalous response-size distributions from the WrongBookController endpoint, indicating bulk data retrieval.

Detection Strategies

• Deploy application-layer logging that records the authenticated principal, the requested subjectId, and the owner of the returned record for every call to the vulnerable controller.
• Alert when the requester's identity does not match the record owner. Legitimate use should never trigger this condition.
• Baseline normal per-user request rates against the endpoint and flag deviations that suggest enumeration.

Monitoring Recommendations

• Forward web-server and application logs to a centralized analytics platform for correlation across sessions.
• Monitor authentication logs for compromised student accounts, which are the prerequisite for exploitation.
• Review egress traffic for large outbound data flows correlated with student portal activity.

How to Mitigate CVE-2025-11321

Immediate Actions Required

• Restrict network exposure of the wisdom-education application to trusted networks or place it behind a VPN until a patched release is available.
• Audit access logs for the WrongBookController endpoint to identify prior enumeration attempts.
• Rotate credentials for any student accounts that show signs of misuse.

Patch Information

No vendor patch is referenced in the NVD entry as of the last modification date. Track the project repository and the VulDB #327202 Details advisory for updated fix information. Until a fix ships, apply the workarounds below or fork the application to add server-side ownership checks in the controller.

Workarounds

• Modify WrongBookController.java to derive the target user identity from the authenticated session rather than from the subjectId request parameter.
• Add a server-side check that rejects requests where the record owner does not match the authenticated principal, returning HTTP 403.
• Place a reverse proxy or web application firewall rule in front of the endpoint to block requests where the subjectId value does not match a value previously issued to the session.

# Example WAF pseudo-rule to block cross-user subjectId access
# Adjust to match your proxy syntax (NGINX, HAProxy, ModSecurity)
SecRule REQUEST_URI "@contains /api/student/wrongbook" \
  "chain,deny,status:403,id:1011321,msg:'CVE-2025-11321 authorization bypass attempt'"
  SecRule ARGS:subjectId "!@streq %{SESSION.subjectId}"