CVE-2025-12918: Yungifez Skuul RCE Vulnerability

CVE-2025-12918 Overview

CVE-2025-12918 affects the yungifez Skuul School Management System through version 2.6.5. The flaw resides in an unknown function of the /dashboard/fees/fee-invoices/ endpoint within the View Fee Invoice component. Attackers can manipulate the invoice_id parameter to trigger improper control of resource identifiers, categorized as an Insecure Direct Object Reference [CWE-639] and Improper Control of Resource Identifiers [CWE-99]. Remote exploitation is possible, though the attack requires low privileges and is rated as high complexity. The vendor was contacted about this disclosure but did not respond, and a public proof-of-concept has been released.

Critical Impact

Authenticated remote attackers can manipulate the invoice_id parameter to access fee invoice data belonging to other users, resulting in limited confidentiality impact on tenant records.

Affected Products

• yungifez Skuul School Management System versions up to and including 2.6.5
• Component: View Fee Invoice (/dashboard/fees/fee-invoices/)
• Vulnerable parameter: invoice_id

Discovery Timeline

• 2025-11-09 - CVE-2025-12918 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12918

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the fee invoice viewing workflow of Skuul School Management System. The application exposes invoice records through the /dashboard/fees/fee-invoices/ endpoint and uses the invoice_id argument to select the record returned to the caller. The application does not adequately verify that the requesting user owns or has authorization to view the referenced invoice.

An authenticated user can iterate or guess invoice_id values to retrieve invoice data belonging to other students, parents, or tenants of the platform. The issue maps to [CWE-639] Authorization Bypass Through User-Controlled Key and [CWE-99] Improper Control of Resource Identifiers.

Root Cause

The root cause is missing object-level authorization on the fee invoice retrieval logic. The backend trusts the client-supplied invoice_id and returns the matching record without validating that the requester has a relationship to the invoice's owning student or account.

Attack Vector

Exploitation occurs over the network against the application's authenticated dashboard. An attacker with a valid low-privileged account submits crafted requests to /dashboard/fees/fee-invoices/ while substituting the invoice_id parameter with values belonging to other users. Because the identifiers are sequential or otherwise predictable, an attacker can enumerate records at scale.

No verified exploit code beyond the public proof-of-concept gist is included here. See the GitHub Gist reproduction steps for the reported reproduction flow.

Detection Methods for CVE-2025-12918

Indicators of Compromise

• Sequential or high-volume HTTP requests to /dashboard/fees/fee-invoices/ from a single authenticated session
• Requests where the invoice_id parameter does not correspond to invoices owned by the requesting account
• Access patterns spanning many distinct invoice_id values in a short interval

Detection Strategies

• Correlate web access logs with application session context to flag requests where the invoice owner differs from the authenticated user
• Deploy Web Application Firewall (WAF) rules that rate-limit or alert on rapid enumeration of the invoice_id parameter
• Review application audit logs for reads of invoices that do not match the acting user's tenant or student assignment

Monitoring Recommendations

• Instrument the fee invoice endpoint to emit structured logs including authenticated user ID, requested invoice_id, and invoice owner
• Alert on anomalous invoice access ratios (for example, one user accessing invoices belonging to more than N distinct accounts)
• Baseline normal invoice access volume per role and trigger alerts on deviation

How to Mitigate CVE-2025-12918

Immediate Actions Required

• Restrict access to /dashboard/fees/fee-invoices/ at the reverse proxy or WAF until an authorization patch is available
• Audit application logs for prior enumeration of invoice_id values and notify affected account holders if disclosure occurred
• Rotate any sensitive data (payment references, contact details) that may have been exposed through unauthorized invoice reads

Patch Information

At the time of publication, the vendor yungifez had not responded to the disclosure and no vendor patch has been referenced in the advisory. Operators should monitor the VulDB entry #331636 and the project repository for updates. Until a fixed release is published, apply the workarounds below.

Workarounds

• Implement a server-side authorization check that validates the authenticated user owns or is otherwise entitled to view the requested invoice before returning data
• Replace sequential numeric identifiers with unguessable UUIDs to raise the cost of enumeration
• Enforce per-session rate limits on the fee invoice endpoint to slow automated enumeration attempts
• Restrict the fee invoice dashboard to trusted network ranges where feasible

# Example nginx rule: rate-limit requests to the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=invoices:10m rate=10r/m;

location /dashboard/fees/fee-invoices/ {
    limit_req zone=invoices burst=5 nodelay;
    proxy_pass http://skuul_backend;
}