CVE-2025-12288 Overview
CVE-2025-12288 is an authorization bypass vulnerability in Bdtask Pharmacy Management System (also known as Pharmacare) up to version 9.4. The flaw resides in the /user/edit_user/ endpoint of the User Profile Handler component. An authenticated remote attacker can manipulate request parameters to bypass authorization checks and modify user profiles belonging to other accounts. The vulnerability is tracked under CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can bypass authorization on the user profile endpoint and modify other users' account data without privilege escalation requirements beyond a low-privileged session.
Affected Products
- Bdtask Pharmacy Management System (Pharmacare) versions up to and including 9.4
- Deployments exposing the /user/edit_user/ endpoint to network access
- Multi-tenant installations sharing a single Pharmacare instance
Discovery Timeline
- 2025-10-27 - CVE-2025-12288 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12288
Vulnerability Analysis
The vulnerability exists in the User Profile Handler component of Pharmacare. The /user/edit_user/ route accepts a user identifier as part of the request but fails to verify that the identifier belongs to the authenticated session. Because the application trusts a client-supplied key, any low-privileged user can substitute another account's identifier and invoke the edit operation. The result is an Insecure Direct Object Reference combined with missing server-side authorization enforcement. Exploitation does not require chaining additional flaws or user interaction. The public proof-of-concept on GitHub demonstrates the manipulation against a default installation.
Root Cause
The root cause is the absence of an authorization check that ties the target user_id parameter to the session-bound identity. The handler performs the database update based solely on the value submitted in the request body, which the attacker controls. This pattern matches CWE-639, where an authorization decision relies on a user-controlled key rather than a server-side session attribute or access control list.
Attack Vector
The attack is remote and requires only a valid low-privileged account on the target instance. An attacker submits a crafted HTTP request to /user/edit_user/ containing the victim's user identifier alongside attacker-supplied profile fields. The server processes the update without confirming ownership. See the GitHub PoC for CVE-2025-12288 and VulDB entry #329956 for request-level technical details.
Detection Methods for CVE-2025-12288
Indicators of Compromise
- Unexpected modifications to user profile fields (name, email, contact, role) without corresponding administrator activity
- HTTP POST requests to /user/edit_user/ where the user_id parameter differs from the session-authenticated user
- Authentication anomalies following profile edits, such as password resets initiated from changed email addresses
Detection Strategies
- Audit application logs for requests to /user/edit_user/ and correlate the submitted user identifier with the session owner
- Enable database-level auditing on the users table to capture row-level updates and the originating session
- Deploy web application firewall rules that flag profile-edit requests where the path parameter or body identifier does not match the authenticated principal
Monitoring Recommendations
- Review historical access logs for any prior exploitation given the public proof-of-concept availability
- Alert on rapid sequential profile edits across different user_id values from a single session
- Monitor support channels for user reports of unauthorized profile or credential changes
How to Mitigate CVE-2025-12288
Immediate Actions Required
- Restrict network access to the Pharmacare application to trusted networks or VPN until a patch is available
- Disable or rate-limit the /user/edit_user/ endpoint at the reverse proxy layer
- Force a password reset and review profile data for all accounts to identify unauthorized modifications
Patch Information
No vendor patch is available. According to the VulDB advisory, Bdtask was contacted but did not respond to the disclosure. Organizations running Pharmacare 9.4 or earlier should treat the issue as unpatched and apply compensating controls.
Workarounds
- Implement a reverse-proxy authorization rule that validates the session cookie against the user_id submitted to /user/edit_user/ and blocks mismatches
- Restrict the application to administrator-only access while a vendor fix is pending
- If source-level changes are feasible, add a server-side check in the edit handler that compares the request user_id against the session identity before executing the update
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
