CVE-2026-5031

BichitroGan ISP Billing Software Endpoint users-view resource injection

View on CVE.org
Published Mar 29, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw was detected in the 2025.3.20 release of BichitroGan ISP Billing Software affecting the Endpoint component’s users‑view route. By manipulating the ID argument, an attacker can cause improper control of resource identifiers, enabling remote resource injection. The public exploit demonstrates that the weakness can be leveraged from outside the network, potentially allowing unauthorized access to or modification of billing or user data.

Affected Systems

This vulnerability applies only to the BichitroGan ISP Billing Software version 2025.3.20. No later, patched release is documented, so all installations of this specific version remain vulnerable.

Risk and Exploitability

With a CVSS score of 5.3 the risk is moderate, yet the attack can reach end‑points remotely and the exploit is publicly available. Although EPSS data is missing and the issue is not listed in CISA’s KEV catalog, the lack of a vendor response underscores the potential for unmitigated exposure if no interim controls are applied.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify whether a newer, patched version of BichitroGan ISP Billing Software exists and upgrade immediately if available
  • Configure web application firewall or network rules to block access to the /?_route=settings/users-view/ endpoint from untrusted sources
  • If customization is possible, enforce strict validation or whitelisting on the ID parameter for the affected route
  • Monitor application logs for signs of unauthorized parameter manipulation or repeated failed requests to the vulnerable endpoint
  • Contact BichitroGan support to request a formal fix and track communication for audit purposes

Generated by OpenCVE AI on March 29, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Bichitrogan
Bichitrogan isp Billing Software
Vendors & Products Bichitrogan
Bichitrogan isp Billing Software
Type Values Removed Values Added
Description A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title BichitroGan ISP Billing Software Endpoint users-view resource injection
Weaknesses CWE-99
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-99

    Improper Control of Resource Identifiers ('Resource Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 1, 2026, 2:27 PM
Reserved
Mar 27, 2026, 4:05 PM

View source JSON

Updated
Apr 1, 2026, 2:27 PM

JSON

Status
Deferred
Published
Mar 29, 2026, 5:15 AM
Modified
Jun 17, 2026, 10:58 AM

View source JSON

No data.

Updated
Mar 30, 2026, 6:58 AM

JSON