Input Validation Flaw in Qualifio's Wheel of Fortune
CVE-2025-0615

5.3MEDIUM

Key Information:

Vendor
Qualifio
Status
Wheel Of Fortune
Vendor
CVE Published:
21 January 2025

Summary

An input validation flaw exists in Qualifio's Wheel of Fortune, which can be exploited by an attacker to manipulate the email input. By inserting a '+' symbol, the attacker can gain unauthorized access to the application, allowing them to enter the game repetitively and potentially win prizes multiple times. This vulnerability underscores the importance of secure input handling to prevent abuse and maintain the integrity of promotional games.

Affected Version(s)

Wheel of fortune all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aldayr Ruiz (xsmaky)
.