SourceCodester Student Grades Management System CVE-2025-12332

Exploitation requires all of the following: (1) Valid administrative credentials or prior compromise of an admin account to access /admin.php; (2) The delete_user function must be accessible and must accept unsanitized input that is reflected or stored without encoding; (3) A second user (administrator or privileged user) must interact with the affected application content (e.g., view a user record containing the injected payload) for the XSS to execute in their browser. The vulnerability does NOT affect unauthenticated users or non-administrative accounts. Default configurations of the application are vulnerable, but practical exploitation is limited to scenarios where an insider threat or account compromise occurs.

This vulnerability presents minimal real-world risk despite POC availability. The CVSS v4.0 score of 1.9 reflects multiple limiting factors: requirement for high administrative privileges (PR:H), mandatory user interaction (UI:P), and limited impact scope (integrity only, no confidentiality or availability impact). The EPSS score of 0.05% (14th percentile) confirms that exploitation probability is very low, placing it well below the median for disclosed vulnerabilities. The contradiction between POC availability and low EPSS suggests the exploit requires a very specific operational context (admin access to a niche educational application) that is uncommon in the wild. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation by threat actors. For most organizations, this is a low-priority issue suitable for standard patch cycles rather than emergency response. However, educational institutions or organizations running this specific application should still remediate, as an internal attacker with admin privileges could potentially perform stored XSS attacks, though with limited technical impact due to the vulnerability's constraints.

An authenticated administrator (or attacker who compromised an admin account) navigates to /admin.php and manipulates the delete_user function to inject malicious JavaScript code into a user deletion request. The payload is stored in the application database. When another administrator or user views the affected user record in the admin interface, the XSS payload executes in their browser, potentially allowing the attacker to steal session cookies, modify admin settings, or perform actions on behalf of the victim.