PHPGurukul Complaint Management System CVE-2025-7802

Exploitation requires an authenticated user with access to the /admin/complaint-search.php endpoint (administrator role or equivalent). The victim must actively click or navigate to a malicious URL crafted by the attacker containing the XSS payload in the Search parameter, and their browser must render and execute the injected script. The vulnerability is NOT exploitable against unauthenticated users or non-admin accounts, and client-side protections (browser XSS filters, CSP policies) may mitigate execution. The attack does not work via direct navigation to the vulnerable parameter by the attacker themselves - it requires social engineering to deceive another authenticated user into visiting the malicious link.

Risk is substantially lower than the CVSS score suggests. CVSS 4.0 reflects the technical attack parameters (network-accessible, low complexity, requires authentication and user interaction), but EPSS 0.05% (16th percentile) indicates minimal real-world exploitation likelihood. No CISA KEV status provided, and despite public POC availability, the combination of authentication requirement (PR:L), mandatory user interaction (UI:P), and low integrity impact (VI:L) creates significant friction. This is a low-priority vulnerability suitable for standard patching cycles rather than emergency response. The authenticated requirement and user interaction necessary for exploitation mean this is not exploitable against the application itself without valid credentials or social engineering, making widespread automated attacks infeasible.

An authenticated admin attacker crafts a malicious URL containing JavaScript payload in the Search parameter (e.g., /admin/complaint-search.php?Search=<script>alert('xss')</script>) and sends it to another administrator via email or internal messaging. When the target admin clicks the link and views the search results, the injected script executes in their browser context, potentially stealing session cookies, performing unauthorized actions on their behalf, or redirecting to a credential harvesting site. Public POC on GitHub confirms the exploit is straightforward to execute.