CVE-2025-13785: Yungifez Skuul Information Disclosure Flaw

CVE-2025-13785 Overview

CVE-2025-13785 is an information disclosure vulnerability in the yungifez Skuul School Management System through version 2.6.5. The flaw resides in the Image Handler component accessed via the /user/profile endpoint. An authenticated remote attacker with low privileges can manipulate the component to expose sensitive information [CWE-200]. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond.

Critical Impact

Remote authenticated attackers can retrieve confidential data served through the profile image handler, exposing user information managed by the school platform.

Affected Products

• yungifez Skuul School Management System versions up to and including 2.6.5
• Component: Image Handler at /user/profile
• Deployments exposing the application to untrusted networks

Discovery Timeline

• 2025-11-30 - CVE-2025-13785 published to NVD
• 2026-09-03 - Last updated in NVD database

Technical Details for CVE-2025-13785

Vulnerability Analysis

The vulnerability resides in the Image Handler logic reachable through the /user/profile route of Skuul School Management System. Processing of unspecified input permits an authenticated attacker to retrieve information that should remain restricted. The issue is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. The EPSS probability is 0.369% at the 28.9th percentile, indicating limited observed exploitation activity. However, public disclosure of exploit material on a third-party gist raises the likelihood of ad-hoc targeting against exposed instances.

Root Cause

The root cause is insufficient access control or output filtering within the Image Handler routine that serves profile media. The handler returns data that an authenticated low-privilege user should not be able to read. Because specific sanitization or authorization logic is not published, administrators should treat the entire /user/profile surface as untrusted until patched.

Attack Vector

Exploitation requires network access to the application and valid low-privilege credentials. No user interaction is required. An attacker crafts a request against the /user/profile Image Handler endpoint to retrieve information outside their authorization scope. Public proof-of-concept material is referenced in VulDB entry VulDB #333789 and a third-party GitHub Gist PoC.

No verified exploit code is reproduced here. Refer to the external references for technical details.

Detection Methods for CVE-2025-13785

Indicators of Compromise

• Unusual volume of authenticated GET requests to /user/profile from a single session or source IP
• Requests to the Image Handler returning content-types or payload sizes inconsistent with normal profile image responses
• Access patterns enumerating multiple user identifiers through the profile endpoint

Detection Strategies

• Review web server and application logs for sequential or scripted requests targeting /user/profile
• Correlate low-privilege account activity with access to resources belonging to other users
• Alert on authenticated sessions that generate a high ratio of profile endpoint requests relative to normal navigation

Monitoring Recommendations

• Enable verbose access logging on the Skuul application and preserve logs for forensic review
• Deploy a web application firewall rule to count and rate-limit requests to the Image Handler
• Monitor for outbound data transfer anomalies originating from the application server

How to Mitigate CVE-2025-13785

Immediate Actions Required

• Restrict network exposure of Skuul School Management System to trusted networks or VPN until a vendor fix is available
• Audit existing user accounts and revoke credentials that are no longer required
• Review historical access logs for /user/profile for signs of enumeration or data retrieval abuse

Patch Information

No vendor patch has been published. The vendor was contacted but did not respond to the disclosure. Track vendor channels and the VulDB CTI entry for future updates. Consider migration to an alternative platform if the vendor remains unresponsive.

Workarounds

• Place the application behind a reverse proxy that enforces strict authorization checks on /user/profile requests
• Implement WAF rules to block anomalous parameters or response patterns from the Image Handler endpoint
• Reduce the number of accounts with access to the application and enforce strong password policies

# Example NGINX reverse-proxy restriction for the profile endpoint
location /user/profile {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=profile_zone burst=5 nodelay;
    proxy_pass http://skuul_backend;
}