CVE-2025-41030 Overview
CVE-2025-41030 is an authorization flaw in Deporsite, a sports facility management platform developed by T-INNOVA. The vulnerability resides in the /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona endpoint. An unauthenticated attacker can query the dni parameter to retrieve information belonging to other users. The issue is categorized under CWE-863: Incorrect Authorization. INCIBE published an advisory describing this and related weaknesses in the product.
Critical Impact
Unauthenticated remote attackers can enumerate and retrieve personal user data by supplying valid Spanish national identifier (DNI) values to a public AJAX endpoint.
Affected Products
- Deporsite by T-INNOVA
- Versions prior to the vendor-supplied fix (specific versions not disclosed in the advisory)
- Deployments exposing the /ajax/TInnova_v2/Integrantes_Recurso_v2_1/ endpoint to untrusted networks
Discovery Timeline
- 2025-09-02 - CVE-2025-41030 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41030
Vulnerability Analysis
The Deporsite web application exposes an AJAX endpoint named buscarPersona under the Integrantes_Recurso_v2_1 controller. The endpoint accepts a dni query parameter and returns user record data. The application does not enforce an authorization check confirming that the caller has permission to view the record identified by that DNI. Any network client that can reach the web server can invoke the endpoint and receive data belonging to other users.
The attack requires no authentication, no user interaction, and low complexity. Confidentiality of stored user information is directly affected, while integrity and availability of the platform are not impacted by this specific issue.
Root Cause
The root cause is missing authorization on a server-side handler that returns identity-linked data. The endpoint treats the presence of the dni parameter as sufficient to release the corresponding record, without validating session state, ownership, or role. This matches the CWE-863 pattern in which the application performs an action without correctly verifying the caller is authorized.
Attack Vector
An attacker sends an HTTP GET request to /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona with a chosen dni value. Because Spanish DNI values follow a defined format and checksum, an attacker can generate or enumerate candidate values and query them in bulk. The server returns matching person records, enabling reconnaissance and personal data harvesting. See the INCIBE Security Notice on Vulnerabilities for the vendor coordination details.
Detection Methods for CVE-2025-41030
Indicators of Compromise
- Unauthenticated HTTP GET requests to /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona containing a dni parameter
- High request volumes from a single client iterating sequential or algorithmically generated DNI values
- Web server access logs showing 200 OK responses to buscarPersona from IP addresses that never authenticated
Detection Strategies
- Add a web application firewall rule that alerts on requests to the buscarPersona endpoint originating from sessions without a valid authenticated cookie
- Baseline normal request rates to the AJAX endpoint and alert on statistical spikes indicating enumeration
- Correlate dni parameter values across requests to identify wordlist-style scans against the personal lookup handler
Monitoring Recommendations
- Forward Deporsite web server access logs to centralized log storage with at least 90 days of retention
- Enable request-body and query-string logging so dni parameter values are captured for forensic review
- Monitor egress traffic from Deporsite hosts for unusually large outbound payloads that may indicate scraped data exfiltration
How to Mitigate CVE-2025-41030
Immediate Actions Required
- Apply the vendor patch referenced in the INCIBE advisory as soon as T-INNOVA makes it available for your deployment
- Restrict network access to the Deporsite management endpoints so only authenticated users on trusted networks can reach /ajax/TInnova_v2/
- Review historical access logs for prior unauthenticated calls to buscarPersona and notify affected users if disclosure occurred
Patch Information
T-INNOVA has coordinated with INCIBE on remediation for this and other issues in Deporsite. Contact T-INNOVA support to obtain the fixed release and confirm that the deployed version enforces authorization on the buscarPersona handler. Full details are documented in the INCIBE Security Notice on Vulnerabilities.
Workarounds
- Deploy a reverse proxy or WAF rule that blocks unauthenticated requests to /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona
- Require session cookies or CSRF tokens for all AJAX endpoints under Integrantes_Recurso_v2_1 until the vendor patch is applied
- Rate-limit requests to the buscarPersona endpoint per source IP to reduce the feasibility of DNI enumeration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
