Online Complaint Site CVE-2025-11530

Authentication as an administrator or user with access to /cms/admin/state.php is required (PR:L in CVSS vector). The vulnerable code path is triggered when the state parameter is processed by the unspecified function in state.php. No special configuration or non-default setup is indicated; any installation of Online Complaint Site 1.0 with accessible administrative endpoints and authenticated access is vulnerable. Exploitation is limited to users or attackers who possess valid administrative credentials.

CVSS 4.0 vector indicates network attack vector with low complexity, but authentication is required (PR:L) and confidentiality/integrity/availability impact are all limited (VC:L, VI:L, VA:L). EPSS score of 0.03% (8th percentile) suggests minimal exploitation probability in practice, placing this below typical threat prioritization thresholds. Exploit code availability (E:P) slightly elevates concern, but the confluence of low CVSS impact scope, mandatory authentication, and minimal EPSS probability indicates this is a low-priority vulnerability affecting only authenticated administrative users. The mismatch between 'public exploit' and 0.03% EPSS suggests limited attacker motivation or niche applicability rather than weaponized widespread threat.

An authenticated administrative user (or attacker who has compromised admin credentials) sends a crafted HTTP request to /cms/admin/state.php with a malicious state parameter containing SQL metacharacters (e.g., state=1' UNION SELECT username, password FROM users--). The unvalidated input is directly concatenated into a SQL query, allowing the attacker to exfiltrate user credentials or sensitive complaint data from the database.