CVE-2025-11151 in CityPLus
Summary
by MITRE • 10/21/2025
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages.
This issue affects CityPLus: before V24.29500.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/04/2026
The vulnerability identified as CVE-2025-11151 represents a critical exposure of sensitive system information to unauthorized actors within the CityPLus software platform developed by Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. This security flaw falls under the broader category of information disclosure vulnerabilities that can significantly compromise system integrity and data confidentiality. The vulnerability specifically enables unauthorized access to unpublished web pages and sensitive system information, creating a substantial risk for organizations relying on this software solution for their operational infrastructure.
The technical implementation of this vulnerability stems from inadequate access controls and insufficient validation mechanisms within the CityPLus application framework. When the software fails to properly authenticate and authorize user requests, it allows malicious actors to enumerate and access web resources that should remain hidden or restricted to authorized personnel only. This exposure occurs through the detection of unpublished web pages that contain sensitive operational data, system configurations, or administrative interfaces. The vulnerability exists in versions prior to V24.29500.1.0, indicating that the developers have likely identified and addressed this weakness in subsequent releases, though the exact nature of the fix remains unspecified in the public description.
The operational impact of this vulnerability extends beyond simple data exposure, as it creates potential entry points for more sophisticated attacks within the target environment. An attacker who successfully exploits this vulnerability can gain insights into the internal structure of the CityPLus system, potentially identifying additional attack vectors or system weaknesses that could lead to further compromise. The exposure of unpublished web pages may reveal administrative interfaces, configuration files, or system logs that contain sensitive information about the organization's infrastructure, user data, or operational procedures. This information disclosure can facilitate advanced persistent threats and make subsequent attacks more effective and targeted.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-200, which addresses the exposure of sensitive information to unauthorized actors, and represents a clear violation of the principle of least privilege. The ATT&CK framework categorizes this issue under reconnaissance activities where adversaries gather information about the target system before launching more sophisticated attacks. Organizations using affected versions of CityPLus should immediately implement mitigations including access control enforcement, web application firewalls, and regular security assessments to prevent exploitation. The vulnerability demonstrates the critical importance of proper input validation and access control mechanisms in preventing unauthorized information disclosure, particularly in enterprise software solutions that handle sensitive operational data for municipal and industrial applications.
The remediation approach for this vulnerability requires immediate patching of affected systems to version V24.29500.1.0 or later, while organizations should also implement network segmentation and monitoring to detect unauthorized access attempts. Security teams should conduct comprehensive audits of all web applications and services to identify similar information disclosure vulnerabilities, as this represents a systemic weakness that may affect other components of the software ecosystem. Regular vulnerability assessments and penetration testing should be implemented to ensure that access controls remain effective against evolving threat landscapes and to maintain compliance with industry security standards and regulatory requirements.