Serosoft Solutions Academia SIS EagleR Information Disclosure Vulnerability

A vulnerability allowing unauthenticated access to sensitive user information has been identified in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118. The issue arises from improper access controls on the API endpoint /rest/cb/executeBasicSearch, which allows attackers to retrieve detailed personal information of all users and students without authentication. The exposed data includes full names, phone numbers, addresses, family information, and email addresses.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive personal information of all users and students within the application.