Executive Summary

CVE-2025-63562 is a Broken Access Control vulnerability in the Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1. It occurs because the server does not properly check authorization on several API endpoints. Authenticated attackers can manipulate request parameters like owner or resource IDs to create, update, or delete resources that belong to other users without permission. This affects resources such as listings, partners, guests, and bookings. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data manipulation including creating, updating, or deleting listings, partners, guests, and bookings owned by other users. This can cause data loss, integrity violations, and privacy breaches, potentially disrupting business operations and damaging trust. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and testing the vulnerable HTTP endpoints for unauthorized access attempts. You can use tools like curl or HTTP clients to send authenticated requests to the following endpoints with manipulated parameters (owner or resource IDs) to check if unauthorized create, update, or delete actions are possible: POST /spgpm/updateListing, DELETE /spgpm/deleteListing, POST /spgpm/updatePartner, DELETE /spgpm/deletePartner, POST /spgpm/updateGuest, POST /updateBooking, DELETE /deleteBooking. Example curl command to test updateListing endpoint: curl -X POST -H "Authorization: Bearer <token>" -d "owner=<other_user_id>&listingDetails=..." https://<target>/spgpm/updateListing. Monitoring logs for suspicious requests to these endpoints with unusual owner or resource IDs can also help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Summer Pearl Group Vacation Rental Management Platform to version 1.0.2 or later, where the vulnerability has been fixed. Until the upgrade is applied, restrict access to the vulnerable endpoints to only trusted users and monitor API usage closely for suspicious parameter manipulation. Implement additional server-side authorization checks to ensure users can only perform actions on resources they own. [1]

Useful 0 Not Useful 0