CVE-2025-63562
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| summerpearlgroup | vacation_rental_management_platform | to 1.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-63562 is a Broken Access Control vulnerability in the Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1. It occurs because the server does not properly check authorization on several API endpoints. Authenticated attackers can manipulate request parameters like owner or resource IDs to create, update, or delete resources that belong to other users without permission. This affects resources such as listings, partners, guests, and bookings. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized data manipulation including creating, updating, or deleting listings, partners, guests, and bookings owned by other users. This can cause data loss, integrity violations, and privacy breaches, potentially disrupting business operations and damaging trust. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and testing the vulnerable HTTP endpoints for unauthorized access attempts. You can use tools like curl or HTTP clients to send authenticated requests to the following endpoints with manipulated parameters (owner or resource IDs) to check if unauthorized create, update, or delete actions are possible: POST /spgpm/updateListing, DELETE /spgpm/deleteListing, POST /spgpm/updatePartner, DELETE /spgpm/deletePartner, POST /spgpm/updateGuest, POST /updateBooking, DELETE /deleteBooking. Example curl command to test updateListing endpoint: curl -X POST -H "Authorization: Bearer <token>" -d "owner=<other_user_id>&listingDetails=..." https://<target>/spgpm/updateListing. Monitoring logs for suspicious requests to these endpoints with unusual owner or resource IDs can also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the Summer Pearl Group Vacation Rental Management Platform to version 1.0.2 or later, where the vulnerability has been fixed. Until the upgrade is applied, restrict access to the vulnerable endpoints to only trusted users and monitor API usage closely for suspicious parameter manipulation. Implement additional server-side authorization checks to ensure users can only perform actions on resources they own. [1]