CVE-2025-1885 in Online Food Delivery System
Summary
by MITRE • 12/19/2025
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forceful Browsing.
This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/06/2026
The CVE-2025-1885 vulnerability represents a critical open redirect flaw within the Online Food Delivery System developed by Restajet Information Technologies Inc. This security weakness manifests as an improper validation of user-supplied input in redirect parameters, allowing malicious actors to craft URLs that automatically redirect users to arbitrary external domains. The vulnerability exists in all versions through the 19122025 release, making it a persistent threat across the affected product lineage. The nature of this flaw places it squarely within the Common Weakness Enumeration category of CWE-601, which specifically addresses URL redirection and forward slash vulnerabilities. The lack of vendor response to early disclosure attempts raises serious concerns about the product's security maintenance and the organization's commitment to addressing known vulnerabilities.
The technical implementation of this open redirect vulnerability occurs when the application fails to properly validate or sanitize redirect URLs passed through user input parameters. Attackers can exploit this by constructing malicious URLs that contain redirect parameters pointing to phishing sites or malicious domains. When unsuspecting users click on these crafted links, they are automatically redirected from the legitimate food delivery platform to the attacker-controlled destination without proper user confirmation or awareness. This behavior creates a dangerous trust relationship exploitation where users believe they are navigating within the trusted application environment while actually being directed to untrusted third-party sites. The vulnerability particularly affects the authentication and session management aspects of the system, as users may be tricked into entering credentials on phishing pages that appear to be part of the legitimate service.
The operational impact of this vulnerability extends far beyond simple navigation redirection, creating significant risks for both end users and the organization. Users may fall victim to credential theft through phishing attacks that leverage the legitimate platform's trust relationship, while the organization faces potential reputational damage and legal liability from compromised user accounts. The forceful browsing aspect of this vulnerability allows attackers to direct users to malicious content or sites that could install malware, collect personal information, or perform other malicious activities. Additionally, this vulnerability enables social engineering campaigns that can be particularly effective due to the perceived legitimacy of the redirecting platform. The open redirect can also facilitate more sophisticated attacks such as cross-site scripting exploitation or session hijacking when combined with other vulnerabilities present in the system.
Security mitigations for CVE-2025-1885 must address both immediate remediation and long-term architectural improvements. The primary fix involves implementing strict validation and whitelisting of redirect destinations, ensuring that all redirect parameters only accept URLs from predetermined trusted domains. Organizations should implement a comprehensive redirect validation mechanism that checks the destination URL against a known good list and rejects any redirection to external domains unless explicitly authorized. Input sanitization techniques should be applied to all redirect parameters, and the application should enforce strict URL parsing to prevent manipulation of redirect targets. Additionally, user awareness mechanisms should be implemented to warn users when redirection occurs, particularly when transitioning to external domains. The system should also incorporate proper logging and monitoring of redirect activities to detect and respond to potential exploitation attempts. Organizations should consider implementing the ATT&CK framework's T1566 technique for phishing and T1071.004 for application layer protocol usage to monitor and detect suspicious redirect behaviors in network traffic. Regular security testing and code reviews should be conducted to prevent similar vulnerabilities from being introduced in future releases, with particular attention to the principle of least privilege in redirect functionality implementation.