Online Complaint Site CVE-2025-11515

Authentication is mandatory - attacker must possess valid user credentials to access the complaint registration functionality, as indicated by the PR:L (low privilege required) CVSS vector. The vulnerable parameter cid must be submitted via the /cms/users/register-complaint.php endpoint, suggesting the user must reach the complaint submission page. No special configuration appears required beyond a default installation of Online Complaint Site 1.0. The attack is limited to the scope of the single affected version (1.0) and does not extend to other versions. The low EPSS score (0.03%) suggests additional practical constraints may exist - such as rate limiting, input filtering on non-vulnerable installations, or WAF deployment - but these are not documented in the CVE description.

The risk profile presents a significant discrepancy between raw CVSS score and real-world exploitation signals. The CVSSv4 vector indicates AV:N (network-accessible) and AC:L (low complexity), but mandates PR:L (low privilege authentication) - a material constraint. The EPSS score of 0.03% percentile (ranked 8th, indicating very low predicted exploitation probability) contradicts the public POC availability. This divergence suggests the vulnerability requires authenticated access and likely targets a niche application with limited deployment footprint, making widespread exploitation unlikely despite public exploit code. The CVSSv4 confidentiality, integrity, and availability impacts are all marked L (low scope), further constraining severity. The presence of public POC elevates the technical feasibility for targeted attacks against known instances, but the authentication requirement and low EPSS score indicate this is not a priority for mass-exploitation campaigns. Organizations running Online Complaint Site 1.0 should prioritize patching or access controls, but this is not a critical Internet-wide threat.

An authenticated user with registered access to the Online Complaint Site logs in and navigates to the complaint registration endpoint. The attacker crafts a malicious HTTP request with a SQL injection payload embedded in the cid parameter (e.g., cid=1' OR '1'='1' --), which is transmitted over the network to /cms/users/register-complaint.php. The backend PHP application concatenates this unsanitized input directly into a SQL query, allowing the attacker to extract sensitive data from the complaint database or modify database records. A public POC demonstrating this attack vector is available on GitHub at https://github.com/Aurion365/cve/issues/2.