CVE-2025-64105: FOSSBilling: IDOR Vulnerability in Support Ticket Creation
FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vulnerable to IDOR through the support ticket creation workflow. By manipulating relid when reltype=order, an authenticated client can create a support ticket that references another client's order they do not own. The ticketCreateForClient() method accepted relid without verifying order ownership for non-upgrade tasks, allowing clients to link a new ticket to another client's order by crafting the request. No cron task automatically processes cancel/upgrade requests from ticket relations; staff action is required. This affects integrity and confidentiality: staff could be misled into acting on the wrong order (e.g., cancellation or upgrade requests). While there is no client-to-client order data exposure, order IDs may appear in ticket context. This issue has been fixed in version 0.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Compensating control
For support ticket creation workflows, ensure staff review/verify that any order referenced in a ticket context (e.g., when rel_type=order and rel_id is provided) belongs to the authenticated client before taking actions such as cancellation or upgrade, since cron does not automatically process cancel/upgrade requests from ticket relations and staff action is required.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64105?
CVE-2025-64105 has a medium severity rating of 5.1 on the CVSS scale.
What does CVE-2025-64105 affect?
CVE-2025-64105 affects FOSSBilling versions 0.6.21 through 0.7.2 due to an IDOR vulnerability in the support ticket creation workflow.
How do I fix CVE-2025-64105?
To fix CVE-2025-64105, upgrade to FOSSBilling version 0.8.0 or later.
What is IDOR in the context of CVE-2025-64105?
IDOR, or Insecure Direct Object References, in CVE-2025-64105 allows an authenticated user to manipulate access to support tickets.
What could happen if CVE-2025-64105 is exploited?
Exploitation of CVE-2025-64105 may lead to unauthorized access to support tickets, potentially compromising sensitive information.