Complaint Management System CVE-2026-75089

The vulnerable endpoint user/check_availability.php must be network-accessible - as a user-facing registration helper page, it is expected to be reachable without authentication in standard deployments. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, no user interaction, and no special attack preparation are required. Exploitation is bounded to deployments where the application is exposed to the network; instances restricted to localhost or internal-only segments are not remotely exploitable. The flaw is specific to PHPGurukul Complaint Management System version 1.0 and the particular check_availability.php file - custom forks or heavily modified installations may or may not share the same code path.

The CVSS 4.0 score of 5.5 (Medium) reflects network-accessible, unauthenticated exploitation with low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and no scope change to subsequent systems. The E:P modifier in the CVSS 4.0 vector independently confirms a proof-of-concept is publicly available, which aligns with the GitHub exploit reference. No EPSS data was supplied in the input, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, meaning active in-the-wild exploitation is not confirmed. PHPGurukul products are predominantly used in educational, student-project, and demo contexts rather than production enterprise deployments, which substantially limits real-world blast radius. The low attack complexity (AC:L, AT:N, PR:N, UI:N) means exploitation is trivially automated, but the limited prevalence of the product constrains aggregate risk. The low-to-moderate impact metrics suggest the SQLi does not provide direct OS-level code execution without database privilege escalation - real-world damage is likely bounded to credential theft and record manipulation.

An unauthenticated remote attacker identifies a publicly accessible instance of PHPGurukul Complaint Management System and sends a crafted HTTP GET or POST request to user/check_availability.php with a SQL injection payload in the email field (e.g., email=attacker@test.com' OR '1'='1). Using the publicly available proof-of-concept from GitHub (https://github.com/niaoniaollll/cve/issues/3) as a reference, the attacker can enumerate database tables, extract user credentials, or manipulate records with minimal technical sophistication.