CVE-2025-3575: Deporsite IDOR Information Disclosure

CVE-2025-3575 Overview

CVE-2025-3575 is an Insecure Direct Object Reference (IDOR) vulnerability in Deporsite from T-INNOVA. The flaw resides in the /helper/Familia/establecerUsuarioSeleccion endpoint, which fails to validate that the value supplied in the idUsuario parameter belongs to the authenticated requester. An unauthenticated attacker can modify this parameter to access sensitive information belonging to other users. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key and is exploitable over the network with no privileges or user interaction.

Critical Impact
Remote attackers can retrieve personally identifiable information and account-specific data from arbitrary Deporsite users by manipulating a single request parameter.

Affected Products

Deporsite (T-INNOVA) — sports management web platform
/helper/Familia/establecerUsuarioSeleccion endpoint
Deployments exposing the Deporsite web application to untrusted networks

Discovery Timeline

2025-04-15 - CVE-2025-3575 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3575

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the Deporsite web application developed by T-INNOVA. The endpoint /helper/Familia/establecerUsuarioSeleccion accepts an idUsuario parameter that directly references an internal user object. The server uses this value to retrieve user records without first verifying that the authenticated session is authorized to view the requested identifier. By substituting another user's numeric identifier into the parameter, an attacker can read information belonging to that account. The result is horizontal authorization bypass against any user known or guessable by ID.

Root Cause

The root cause is missing object-level authorization on a user-controlled key. The application treats the idUsuario request parameter as trusted input and performs lookups against the user data store without correlating the value to the active session principal. This is the canonical pattern described by CWE-639, where access decisions rely on a client-supplied identifier rather than server-side session state.

Attack Vector

Exploitation occurs entirely over HTTP. An attacker issues a request to /helper/Familia/establecerUsuarioSeleccion while supplying an idUsuario value corresponding to a different user. Because user identifiers are typically sequential integers, attackers can enumerate the namespace through automated iteration. No special tooling, authentication, or social engineering is required. Refer to the INCIBE Security Notice for the official advisory and additional context.

No public proof-of-concept code has been released. The exploitation pattern follows the standard IDOR technique: capture a legitimate request to the endpoint, modify the idUsuario value, and replay the request.

Detection Methods for CVE-2025-3575

Indicators of Compromise

Multiple sequential or non-sequential idUsuario values requested by a single client session against /helper/Familia/establecerUsuarioSeleccion.
High-volume HTTP requests to the establecerUsuarioSeleccion endpoint from a single source IP within a short window.
Responses to the endpoint returning user data inconsistent with the authenticated session identity in application logs.

Detection Strategies

Inspect web server and application logs for requests to /helper/Familia/establecerUsuarioSeleccion where idUsuario does not match the session owner.
Deploy Web Application Firewall (WAF) rules that flag parameter tampering and rapid enumeration of numeric identifiers.
Correlate session identifiers with idUsuario values across request streams to surface horizontal access attempts.

Monitoring Recommendations

Enable verbose logging on the Deporsite endpoint, capturing session ID, source IP, user-agent, and the submitted idUsuario value.
Forward access logs to a centralized SIEM or data lake and alert on enumeration patterns and anomalous request rates.
Monitor for outbound data volume spikes from the Deporsite application server that could indicate bulk data scraping.

How to Mitigate CVE-2025-3575

Immediate Actions Required

Contact T-INNOVA to obtain the fixed Deporsite build referenced in the INCIBE advisory and schedule deployment.
Restrict access to the Deporsite application to trusted networks or authenticated VPN users until the patch is applied.
Audit application logs since the published date of 2025-04-15 for evidence of idUsuario parameter abuse.

Patch Information

No vendor patch URLs or fixed version identifiers are listed in the public CVE record. Administrators must coordinate directly with T-INNOVA to obtain remediation. The INCIBE-CERT advisory is the authoritative reference for affected versions and vendor remediation guidance.

Workarounds

Implement a reverse-proxy or WAF rule that compares the idUsuario parameter against the authenticated session's user identifier and blocks mismatches.
Replace exposed numeric idUsuario values with unpredictable per-session tokens at the proxy layer so identifier enumeration becomes infeasible.
Rate-limit requests to /helper/Familia/establecerUsuarioSeleccion to slow brute-force enumeration while the patch is being deployed.

bash

# Example ModSecurity rule to block obvious idUsuario tampering attempts
SecRule REQUEST_URI "@beginsWith /helper/Familia/establecerUsuarioSeleccion" \
    "id:1003575,phase:2,deny,status:403,log,\
    msg:'CVE-2025-3575 IDOR attempt on Deporsite endpoint',\
    chain"
    SecRule ARGS:idUsuario "!@streq %{SESSION.user_id}" "t:none"