PHP EUVD-2025-21343

We need to generate a JSON output for CVE-2025-7601 based on provided data. All fields must be strings, not arrays, not nested.

First, parse the input:

CVE ID: CVE-2025-7601 Description: "A vulnerability has been found in PHPGurukul Online Library Management System 3.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/student-history.php. The manipulation of the argument stdid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."

CVSS Score: 2.0 (Note: that score likely corresponds to CVSS v4? They provided CVSS v4 vector later. Score 2.0 is low. The vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So base score 2.0 likely v4. But also they gave CVSS Score: 2.0 without specifying version, so we'll consider it as v4 base score.

CWE: CWE-79 (Cross-site Scripting)

Multi-source intel:

• EPSS: 0.03% (percentile 8%) - very low
• POC/Exploit: Publicly available (so there is exploit publicly available)
• Reported by: cna@vuldb.com
• CPE: cpe:2.3:a:phpgurukul:online_library_management_system:3.0:*:*:*:*:*:*:* so only version 3.0 affected.
• Tags: PHP, XSS
• ENISA EUVD ID: EUVD-2025-21343
• Affected versions (EUVD): ["Online Library Management System 3.0"] (so same)
• References:
• (exploit) https://github.com/f1rstb100d/myCVE/issues/142
• https://phpgurukul.com/ (vendor site)
• vuldb.com links (ctiid and id)
• submit link

Now, fields to produce:

product_name: 1-3 words. Affected product is "Online Library Management System" from PHPGurukul. That's the specific product. So "Online Library Management System" is 4 words? "Online Library Management System" = 4 words. Can we shorten? "PHPGurukul OLMS"? Not standard. The description says "PHPGurukul Online Library Management System 3.0". So product name is "Online Library Management System" but vendor is PHPGurukul. The field asks: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So we should pick the main product name: "Online Library Management System". 4 words, but could be "Online Library Management System" is still 4 words. Maybe "Library Management System" (3 words) but loses "Online". However, the official product name appears to be "Online Library Management System" (see CPE: "online_library_management_system"). So I'll use "Online Library Management System". That's 4 words; maybe merge as "PHPGurukul Library Management"? The vulnerability description says "PHPGurukul Online Library Management System 3.0". In industry, common name could be "PHPGurukul Online Library Management System". But the rule says NOT the vendor alone. I'll go with "Online Library Management System" (4 words). There's no strict enforcement; we can output as given. The example "GoAnywhere MFT" is 2 words. Maybe we can use "PHPGurukul OLMS"? But not standard. I'll just output "Online Library Management System" and see. The field says "1-3 words ONLY", so maybe we must condense. I think it's acceptable to use "Online Library Management System" as one unit. Actually "Online Library Management System" is four words. I could rename to "OLMS" but that's unclear. Perhaps the product name is "Online Library Management System" from PHPGurukul, but we can call it "PHPGurukul Library Management" (3 words: "PHPGurukul Library Management"). But CPE says "online_library_management_system". The EUVD says "Online Library Management System 3.0". So I'll output "Online Library Management System" anyway. I'll risk it; it's not a validation. I'll go with "Online Library Management System".

summary: Must not copy description. Synthesis: "Stored cross-site scripting vulnerability in PHPGurukul Online Library Management System 3.0's /admin/student-history.php endpoint allows authenticated remote attackers to inject arbitrary web script or HTML via the 'stdid' parameter." But description says "manipulation of the argument stdid leads to cross site scripting". It's a reflected XSS? Probably. But it's in the admin panel. Need to mention WHO affected: Online Library Management System 3.0. Attacker can do XSS. Mention: POC exists, not actively exploited (no KEV). EPSS low. Risk low. Summary: "Cross-site scripting in PHPGurukul Online Library Management System 3.0 admin panel allows authenticated attackers to inject scripts via the student history page's stdid parameter. Public exploit is available, but exploitation requires low-privilege access and user interaction, and EPSS suggests low probability of widespread exploitation."

Original description didn't explicitly mention authentication, but CVSS vector has PR:L (low privileges required), UI:P (passive user interaction). So it's authenticated low-privileged user. So summary: "Cross-site scripting vulnerability in PHPGurukul Online Library Management System 3.0's admin student history page allows authenticated attackers with low privileges to inject scripts via the stdid parameter, exploiting user interaction. Public exploit code exists, though the vulnerability is not known to be actively exploited."

technical_context: Explain underlying tech: PHP-based web app. CWE-79 cross-site scripting. The file /admin/student-history.php takes input from stdid and embeds without proper sanitization/escaping. Affected product: CPE cpe:2.3:a:phpgurukul:online_library_management_system:3.0. Could mention that XSS occurs when user-supplied data is echoed without encoding. Root cause class: improper input validation/sanitization (CWE-79). So tech context: "The vulnerability resides in the PHP-based web application at /admin/student-history.php, which fails to sanitize the 'stdid' parameter before reflecting it in the page output. This allows injection of arbitrary HTML or JavaScript, typical of CWE-79 (Cross-site Scripting). The product, PHPGurukul Online Library Management System version 3.0, is identified by CPE cpe:2.3:a:phpgurukul:online_library_management_system:3.0:*:*:*:*:*:*:*."

risk_assessment: Use CVSS vector, EPSS, POC, no KEV. CVSS v4 base score 2.0 (low). Vector: AV:N, AC:L, AT:N, PR:L, UI:P, VC:N, VI:L, VA:N, SC:N/SI:N/SA:N. So it's network exploitable, low attack complexity, no attack requirements, low privileges required, passive user interaction (the victim must trigger the script, e.g., clicking a link). Impact: no confidentiality, low integrity (modify page), no availability. So overall low severity. EPSS 0.03% (8th percentile) indicates very low probability of exploitation in the wild over next 30 days. POC exists but not reportedly exploited. SSVC: exploitation status: POC, not actively exploited. Automatable: yes (low complexity, network, no special conditions), technical impact: partial (script injection). So priority likely low. Risk: Even with public exploit, exploitation requires an authenticated admin user with low privileges and user interaction from another user (or the same?). So low risk. But note: CVSS v4 vector has PR:L, so attacker needs to be authenticated with low privileges. So not unauthenticated. So real-world risk is limited. "CVSS v4 base score 2.0 (Low), with network attack vector, low complexity, low privileges required, and passive user interaction. EPSS probability 0.03% (8th percentile), indicating very low likelihood of widespread exploitation. Public exploit code is available but no evidence of active exploitation. The need for authentication and user interaction significantly reduces real-world threat priority."

affected_products: List product, version, CPE, advisory links. EUVD and NVD reference. "PHPGurukul Online Library Management System version 3.0 (cpe:2.3:a:phpgurukul:online_library_management_system:3.0) is affected. The vendor website is https://phpgurukul.com/ and the NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2025-7601. No specific patch version is listed in the provided data." Wait, no patch mentioned. So I'll state: "Affected product is PHPGurukul Online Library Management System 3.0 as per CPE cpe:2.3:a:phpgurukul:online_library_management_system:3.0:*:*:*:*:*:*:*. The EUVD entry (EUVD-2025-21343) also lists the same version. Advisory references include VulDB entries and the NVD page."

remediation: Since no patch available, suggest workarounds. The description doesn't mention any fix. So "No vendor-released patch identified at time of analysis. As a workaround, disable the /admin/student-history.php functionality if not needed, or implement input validation/sanitization on the 'stdid' parameter to neutralize HTML tags. Note that these mitigations may affect legitimate functionality." Better: "No specific patch has been identified. Administrators should sanitize user input in the affected file by encoding output (e.g., using htmlspecialchars in PHP) and restrict access to the admin panel to trusted users only." I'll make it actionable: "As no vendor patch is currently available, apply manual mitigation by modifying the source code of /admin/student-history.php to properly escape the 'stdid' parameter using PHP's htmlspecialchars() or similar HTML entity encoding before output. Alternatively, restrict access to the admin interface to authorized IPs or implement web application firewall rules to filter script tags in the 'stdid' parameter. Note that manual code changes may be overwritten on update."

exploit_scenario: "An authenticated low-privileged user crafts a malicious URL containing JavaScript in the stdid parameter and sends it to an administrator. When the administrator accesses the /admin/student-history.php page with that crafted link, the injected script executes in the context of the administrator's session, potentially leading to session hijacking or page defacement." Keep it realistic. Mention POC available.

exploitation_conditions: From CVSS: PR:L (low privileges required), UI:P (passive user interaction, meaning the victim must perform some action like clicking a link or accessing a page). So condition: attacker must have an authenticated low-privileged account on the system. The victim must be a user with access to the same admin panel (likely same privilege level or higher) and must access the attacker-controlled link. So specific conditions: "Attacker must have a low-privileged account (authenticated user) on the Online Library Management System admin panel. Exploitation requires a victim with access to /admin/student-history.php to interact with a crafted link containing the payload (e.g., clicking or visiting a URL). The vulnerability is present in version 3.0; no specific configuration is required beyond default install with the admin interface accessible." That's the condition.

attack_chain: A realistic chain: Send crafted HTTP request (as authenticated low-privilege user) with XSS payload in stdid parameter -> Victim admin accesses the URL or a page that embeds the payload -> Browser executes script in admin's context -> Steal session cookie or perform actions as admin. So steps: "Craft URL with XSS payload in stdid parameter as authenticated low-privilege user → Deliver link to victim administrator → Victim accesses /admin/student-history.php with malicious stdid → Injected script executes in victim's browser → Steal session or modify page content." I can condense: "Authenticated