Vulnerability · Published May 26, 2025 · Assigned by VulDB
CVE-2025-5182Summer Pearl Group Vacation Rental Management Platform Listing authorization
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Vacation Rental Management Platform from Summer Pearl Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Summer Pearl Group | Vacation Rental Management Platform | 1.0.01.0.1 |
Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- VDB-310270 | Summer Pearl Group Vacation Rental Management Platform Listing authorization vdb-entry
- VDB-310270 | CTI Indicators (IOB, IOC) signature, permissions-required
- https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS related
- https://summerpearlgroup.gr/spgpm/releases patch
- https://www.youtube.com/watch?v=0wwuatTa6sU media-coverage