Online Complaint Site CVE-2025-11516

Authentication is required - the attacker must have a valid user account and be logged into the application (PR:L in CVSS vector). The vulnerable /cms/users/complaint-details.php endpoint must be accessible from the network where the attacker operates (AV:N). No special configuration or feature enablement is required; standard installation of Online Complaint Site 1.0 contains the vulnerability. Exploitation does not require user interaction from other parties (UI:N). The impact is limited to data disclosure; no data modification, system unavailability, or privilege escalation is possible through this SQLi variant (VC:L/VI:L/VA:L).

Multiple indicators suggest lower real-world risk despite public exploit availability. CVSS v4.0 vector shows authentication requirement (PR:L), network access, and limited impact scope (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), resulting in the low score of 2.1. EPSS at 0.03% percentile ranks this among the least exploitable CVEs, contradicting the 'publicly available' exploit status - this discrepancy suggests the POC may be a proof-of-concept demonstration rather than a weaponizable, widely-used exploit. The E:P modifier indicates proof of concept exists but does not confirm active widespread exploitation. Attack surface is limited to authenticated users only, significantly reducing threat actor interest compared to unauthenticated SQL injection. Risk is further constrained by the apparent niche status of code-projects Online Complaint Site as a self-hosted complaint management system with likely limited deployment. Defenders should prioritize patching or isolation based on whether the system handles sensitive personal data rather than raw CVSS score.

An authenticated application user crafts a malicious request to /cms/users/complaint-details.php?cid=1' UNION SELECT password FROM users -- to extract password hashes from the database. The unvalidated cid parameter is concatenated directly into the SQL query, executing the injected UNION clause. Query results are reflected in complaint details output, allowing the attacker to exfiltrate sensitive data without triggering alerts due to appearing as a normal authenticated request.