CVE-2025-14889
BaseFortify
Publication date: 2025-12-18
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| campcodes | advanced_voting_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14889 is an authorization bypass vulnerability in Campcodes Advanced Voting Management System 1.0, specifically in the /admin/voters_edit.php file. It allows an authenticated voter (non-admin) to manipulate the 'id' parameter to reset the password of any arbitrary voter account without proper authorization checks. This happens because the system lacks role-based access control and does not validate ownership of the targeted voter account, enabling unauthorized password resets and full account takeover. The vulnerability is classified as an Authorization Bypass/Insecure Direct Object Reference (IDOR) and relates to CWE-639 and CWE-285. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to horizontal privilege escalation where a normal voter can reset passwords of other voters, resulting in arbitrary voter account takeover and unauthorized credential modification. It compromises the integrity of the election process by allowing attackers to take over voter accounts and potentially manipulate election outcomes. The attack can be performed remotely with low complexity and requires only normal voter authentication. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized POST requests to the administrative endpoint `/votesystem/admin/voters_edit.php` where the `id` parameter is manipulated to reset passwords of arbitrary voter accounts. Detection can involve checking web server logs or using tools like curl to test if password resets can be performed by non-admin users. For example, after authenticating as a normal voter, you can use a curl command to attempt a password reset on another voter ID: `curl -X POST -b cookie.txt -d "id=TARGET_VOTER_ID&password=NewPass123" https://yourserver/votesystem/admin/voters_edit.php` and observe if the response indicates success. Additionally, Google dorking with the query `inurl:admin/voters_edit.php` can help identify exposed vulnerable endpoints. Monitoring for such unauthorized access attempts or unusual password reset activities can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include enforcing strict role-based access control on all `/admin/*` endpoints to ensure only authorized administrators can access them. Validate that the authenticated user is authorized to modify the targeted voter account, restricting password changes to account owners or administrators only. Implement proper access control middleware for sensitive actions to prevent unauthorized manipulation of the `id` parameter. If possible, restrict access to the vulnerable endpoint via network controls or temporarily disable the affected functionality until a patch or update is applied. Consider replacing the affected product with a secure alternative if no patch is available. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized password resets and full account takeover of voter accounts, leading to compromise of election integrity and unauthorized access to personal voter information. Such unauthorized access and manipulation of personal data can result in non-compliance with data protection regulations like GDPR, which require strict access controls and protection of personal data. Similarly, it may violate standards requiring integrity and confidentiality of sensitive information. Therefore, this vulnerability negatively impacts compliance with common standards and regulations by enabling unauthorized access and modification of sensitive voter data. [1]