CVE-2025-45083 - FULL DISCLOSURE

CVE ASSIGNED: CVE-2025-45083
CVE PUBLISHED STATE: PUBLISHED
CVE LINK: https://nvd.nist.gov/vuln/detail/CVE-2025-45083

Description:
An Incorrect Access Control vulnerability exists in Ullu App Android v2.9.929, iOS v2.8.0, and the Ullu Web Platform (https://ullu.app). The application's parental PIN protection feature can be bypassed by attackers via brute force techniques, due to the lack of rate-limiting or lockout mechanisms on PIN entry. This allows unauthorized users to disable the parental lock feature and gain unrestricted access to adult content on the platform.

For mobile apps, the 4-digit PIN can be brute-forced locally via (manually) or by intercepting using tools like Frida. For the web version, attackers can simply capture and replay the HTTP request for parental PIN disablement and automate a brute-force attack without triggering any defensive mechanism.


Impact:
1.Bypass of Parental Controls, exposing restricted content to unauthorized users
2.Violation of content accessibility protections, especially for underage users
3.Escalation of privileges by circumventing access restrictions
4.Legal and compliance risks related to age-restricted content delivery

Attack Scenario:
Web:
1.User navigates to https://ullu.app/
2.Captures the HTTP request sent when entering a parental PIN
3.Brute-forces the 4-digit PIN using automated scripts (e.g., via Burp Intruder or custom Python script)
4.Disables parental control without authorization

Android & iOS App:
1.Attacker installs the app
2.Logs in using leaked credentials for any account but gets blocked due to parental PIN protection.
3.Sends repeated PIN attempts until the correct one is identified (via Frida)
4.Alternatively, manually tries PINs within the app interface (0000–9999)

Technical Details:
1.Vulnerability Type: Incorrect Access Control
2.CWE Classification: CWE-284 – Improper Access Control
3.Attack Type: Remote (for web), Local/Remote (for apps)

Affected Versions:
1.Android App: v2.9.929 (Play Store)
2.IOS App: v2.8.0 (App Store)
3.Web Platform: https://ullu.app

Impact: Escalation of Privileges, Inappropriate Content Exposure

Affected Products:
1.Ullu Web Platform: https://ullu.app
2.Ullu Android App: https://play.google.com/store/apps/details?id=cdi.videostreaming.app (v2.9.929)
3.Ullu iOS App: https://apps.apple.com/us/app/ullu/id1435281792 (v2.8.0)

Vendor Information:
1.Vendor: Ullu
2.Website: https://ullu.app/

Proof of Concept (PoC):
Web:
1.Intercept the HTTP request triggered by entering the parental PIN
2.Use a script or Burp Intruder to iterate through 0000–9999 PINs
3.Parental PIN is eventually disabled, and restricted content becomes accessible
4.POC for web at - https://drive.google.com/file/d/1gVZDcBDvkQzw12SKBvRYgcaQt4UoC_KP/view?usp=sharing

Apps (Android/iOS):
1.Use a proxy (e.g., Burp Suite) or local instrumentation (e.g., Frida)
2.Identify the endpoint or local logic verifying the PIN (Frida)
3.Iterate all 4-digit PIN combinations using automated input or request fuzzing
4.Successful PIN bypass results in unlocking adult content
5.POC for app at - https://drive.google.com/file/d/1-wUA6dNIMVbv-KV7ZUDnTtC4_avh5pGf/view?usp=sharing

Discoverer:
Ishwar Kumar
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).