CVE-2025-63611
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-01-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpgurukul | hostel_management_system | 2.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in the phpgurukul Hostel Management System v2.1. It occurs because user-provided complaint fields (specifically the 'Explain the Complaint' field) submitted via /register-complaint.php are stored and then displayed without proper escaping in the admin viewer page (/admin/complaint-details.php). As a result, when an administrator views the complaint, any injected HTML or JavaScript code executes in the admin's browser.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the administrator's browser when they view the complaint details. This can lead to unauthorized actions such as stealing admin session cookies, defacing the admin interface, or performing actions on behalf of the admin, potentially compromising the security and integrity of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the complaint submission form (/register-complaint.php) for Cross-Site Scripting (XSS) by injecting HTML or JavaScript payloads into the 'Explain the Complaint' field and then checking if the injected code executes when viewing the complaint in the admin viewer (/admin/complaint-details.php?cid=<id>). Commands to detect this could include using curl or wget to submit payloads and then retrieving the complaint details page to see if the payload is rendered unescaped. For example, use curl to POST a payload: curl -d "complaint=<script>alert(1)</script>" -X POST http://yourhost/register-complaint.php and then fetch the complaint details page with curl or a browser to observe if the script executes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing and escaping user input in the 'Explain the Complaint' field before storing or rendering it, especially in the admin viewer page (/admin/complaint-details.php). Applying input validation and output encoding to prevent execution of injected scripts is critical. Additionally, restricting admin access to trusted users and using Content Security Policy (CSP) headers can help reduce the impact of XSS attacks until a patch is applied.