Hostel Management System EUVD-2025-18443

CVSS 7.3 indicates high severity with Network-accessible attack vector (AV:N), Low attack complexity (AC:L), requiring No privileges (PR:N) and No user interaction (UI:N). While CVSS severity is elevated, the real-world risk is substantial when cross-referenced with additional signals: (1) Public exploit disclosure means attackers possess working POC code; (2) Attack vector is unauthenticated and remote, eliminating barriers to exploitation; (3) SQL injection at authentication layer provides maximum technical impact—complete authentication bypass and database compromise; (4) Login endpoints are typically scanned continuously by automated tools, making this highly automatable; (5) Hostel management systems often contain PII (student names, contact info, payment data). Despite a moderate CVSS score not reaching 9.0+, the combination of public POC, zero authentication barriers, critical business logic impact, and high automation potential elevates this to critical priority. SSVC framework would classify as Exploitation: active/PoC available, Automatable: yes, Technical Impact: total. This is a legitimate high-priority threat, not a false alarm.

An attacker performs reconnaissance on a hostel's web application and identifies the login page powered by PHPGurukul Hostel Management System 1.0. They craft a simple SQL injection payload in the Username field, such as: ' OR '1'='1' -- or ' UNION SELECT username, password FROM users -- . Due to lack of input sanitization, this payload is concatenated directly into the SQL query, e.g., SELECT * FROM users WHERE username='' OR '1'='1' -- '. The query returns all user records regardless of password, bypassing authentication. The attacker gains access to the admin panel without credentials, then extracts the entire student/staff database containing personal information, payment records, and room assignments. They may also modify records, inject backdoors, or launch further attacks on the network. Given the public POC availability, this attack requires minimal sophistication—script kiddies with basic SQL knowledge can exploit this at scale across multiple vulnerable instances.