Vulnerability · Published Jun 20, 2025 · Assigned by VulDB
CVE-2025-6329ScriptAndTools Real Estate Management System User Delete userdelete.php authorization
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in Real Estate Management System from ScriptAndTools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ScriptAndTools | Real Estate Management System | 1.0 |
Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-313325 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization vdb-entry, technical-description
- VDB-313325 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #596472 | Script And Tools Real-Estate-Management-System 1.0 Insecure Direct Object Reference (IDOR) third-party-advisory
- https://www.websecurityinsights.my.id/2025/06/script-and-tools-real-estate-management.html exploit