Vulnerability

CERT-In Vulnerability Note CIVN-2025-0048
Multiple Vulnerabilities in Rising Technosoft CAP back office application

Original Issue Date:March 13, 2025

Severity Rating: HIGH

Systems Affected

Rising Technosoft CAP back office application - all versions prior to 2.0.4

Overview

Multiple vulnerabilities have been reported in Rising Technosoft�s CAP back office application, which could allow a remote attacker to perform account takeover, OTP bombing or gain unauthorized access to sensitive information of other user accounts.

Target Audience:
End-users of Rising Technosoft CAP back office application.

Risk Assessment:
High risk of unauthorized access, data breaches and potential financial losses.

Impact Assessment:
Unauthorized access to sensitive user information and compromised user accounts.

Description

Rising Technosofts CAP back office application is a Windows-based software designed to handle key functions related to stock brokers and depository participants.

1. Improper Authentication Vulnerability ( CVE-2025-29994   )

This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to other user accounts.

2. Account Takeover Vulnerability ( CVE-2025-29995   )

This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.

3. Authentication Bypass Vulnerability ( CVE-2025-29996   )

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

4. Improper Access Control Vulnerability ( CVE-2025-29997   )

This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts.

5. No Rate Limiting Vulnerability ( CVE-2025-29998   )

This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

Credit

These vulnerabilities are reported by Mohit Gadiya.

Solution

Upgrade Rising Technosoft CAP back office application to the version 2.0.4 or later.

Vendor Information

Rising Technosoft
https://risingsoftech.com/Services.aspx

References

Rising Technosoft
https://risingsoftech.com/Services.aspx

CVE Name
CVE-2025-29994
CVE-2025-29995
CVE-2025-29996
CVE-2025-29997
CVE-2025-29998

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India