Vulnerability

CERT-In Vulnerability Note CIVN-2025-0020
Multiple Vulnerabilities in RupeeWeb

Original Issue Date:February 14, 2025

Severity Rating: HIGH

Systems Affected

RupeeWeb - All versions prior to 66.9

Overview

Multiple vulnerabilities have been reported in RupeeWeb, which could allow a remote attacker to perform authentication bypass or OTP bombing or unauthorized information modification on other user accounts.

Target Audience:
End-users of RupeeWeb trading platform.

Risk Assessment:
Data breach, identity theft and financial losses.

Impact Assessment:
Unauthorized access to other user accounts.

Description

RupeeWeb is a web trading platform designed for stock market transactions, real-time market data, advanced analytics, and user-friendly interface.

1. Authentication Bypass Vulnerability ( CVE-2025-26522   )

This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses.

Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

2. Insufficient Authorization Vulnerability ( CVE-2025-26523   )

This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other users.

3. No Rate Limiting Vulnerability ( CVE-2025-26524   )

This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/flooding on the targeted system.

Credit

These vulnerabilities are reported by Mohit Gadiya.

Solution

Upgrade RupeeWeb to version 66.9

Vendor Information

Rupeeseed Technology Ventures
https://www.rupeeseed.com/solutions/rupeeweb/

References

Rupeeseed Technology Ventures
https://www.rupeeseed.com/solutions/rupeeweb/

CVE Name
CVE-2025-26522
CVE-2025-26523
CVE-2025-26524

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India