CVE-2025-13125 - Vulnerability Details - OpenCVE

Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.This issue affects DijiDemi: through 28.11.2025.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Im Park	Dijidemi

No data.

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-25-0442

History

Thu, 11 Dec 2025 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Im Park Im Park dijidemi
Vendors & Products		Im Park Im Park dijidemi

Wed, 10 Dec 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Dec 2025 14:30:00 +0000

Type	Values Removed	Values Added
Description		Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.This issue affects DijiDemi: through 28.11.2025.
Title		IDOR in Im Park's DijiDemi
Weaknesses		CWE-639
References		https://www.usom.gov.tr/bildirim/tr-25-0442
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2025-12-10T14:11:09.650Z

Updated: 2025-12-10T14:34:33.254Z

Reserved: 2025-11-13T12:58:07.164Z

Link: CVE-2025-13125

Vulnrichment

Updated: 2025-12-10T14:34:30.838Z

NVD

Status : Received

Published: 2025-12-10T15:15:56.233

Modified: 2025-12-10T15:15:56.233

Link: CVE-2025-13125

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13125", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-11-13T12:58:07.164Z", "datePublished": "2025-12-10T14:11:09.650Z", "dateUpdated": "2025-12-10T14:34:33.254Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DijiDemi", "vendor": "Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co.", "versions": [{"lessThanOrEqual": "28.11.2025", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammet Emirhan S\u00dcMER"}], "datePublic": "2025-12-10T14:09:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.<p>This issue affects DijiDemi: through 28.11.2025.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.This issue affects DijiDemi: through 28.11.2025."}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-12-10T14:11:09.650Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0442"}], "source": {"advisory": "TR-25-0442", "defect": ["TR-25-0442"], "discovery": "UNKNOWN"}, "title": "IDOR in Im Park's DijiDemi", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-10T14:31:59.622957Z", "id": "CVE-2025-13125", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T14:34:33.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T14:31:59.622957Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T14:34:30.838Z"}}], "cna": {"title": "IDOR in Im Park's DijiDemi", "source": {"defect": ["TR-25-0442"], "advisory": "TR-25-0442", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Muhammet Emirhan S\u00dcMER"}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co.", "product": "DijiDemi", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "28.11.2025"}], "defaultStatus": "unaffected"}], "datePublic": "2025-12-10T14:09:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0442"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.This issue affects DijiDemi: through 28.11.2025.", "supportingMedia": [{"type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers.<p>This issue affects DijiDemi: through 28.11.2025.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-12-10T14:11:09.650Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13125", "state": "PUBLISHED", "dateUpdated": "2025-12-10T14:34:33.254Z", "dateReserved": "2025-11-13T12:58:07.164Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-12-10T14:11:09.650Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}