PHPGurukul Complaint Management System CVE-2025-7834

The attack requires: (1) the victim to be authenticated to PHPGurukul Complaint Management System 2.0 at the time of exploitation; (2) the victim to visit or interact with an attacker-controlled webpage or malicious link (user interaction mandatory per UI:P in CVSS vector); (3) the vulnerable application to lack anti-CSRF protections such as synchronizer tokens or SameSite cookie attributes. No network configuration, special product settings, or non-default deployment is explicitly required-the application is vulnerable in standard configurations if the unknown affected function does not validate request origins.

Despite the low CVSS score (2.1), this vulnerability merits attention due to conflicting signals. The CVSS vector indicates UI:P (user interaction required) and VI:L (limited integrity impact), which legitimately lower risk compared to unauthenticated, no-interaction exploits. However, the EPSS score of 0.08% (percentile 24%) suggests minimal real-world exploitation probability, and there is no CISA KEV listing. The publicly available POC indicates attackers have disclosure-quality code but face practical barriers: the attack requires victims to visit attacker-controlled content while maintaining active sessions to the complaint management system. In practice, this affects organizations running unpatched PHPGurukul installations where users may be social-engineered. The low EPSS despite POC availability suggests limited autonomous exploitation potential-this is not a worm-propagating vulnerability. For defenders, priority depends on deployment context: internal complaint systems with limited external user exposure carry minimal risk; customer-facing systems require remediation.

An attacker crafts a malicious webpage or email containing a CSRF payload (e.g., a hidden form that submits a complaint modification or deletion request). When a logged-in user of the complaint management system visits the attacker's page, the browser automatically includes their authenticated session cookie with the forged request, causing unintended actions such as modifying complaints, changing statuses, or potentially deleting records-all without the user's knowledge or explicit consent.