CVE-2025-63955
📋 TL;DR
A CSRF vulnerability in PHPGurukul Student Record System v3.2 allows attackers to trick authenticated administrators into executing unauthorized account deletion requests. This leads to denial of service by removing legitimate user accounts. Only systems running the vulnerable version with administrator access are affected.
💻 Affected Systems
- PHPGurukul Student Record System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system disruption through mass account deletion, requiring manual account restoration and causing extended service unavailability.
Likely Case
Targeted deletion of key administrator or student accounts, causing partial service disruption and administrative overhead.
If Mitigated
No impact if CSRF protections are implemented or administrators don't click malicious links.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated administrators into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/student-record-system-php/
Restart Required: No
Instructions:
1. Check vendor website for updates
2. If patch available, download and replace manage-students.php
3. Verify CSRF tokens are implemented in all form submissions
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to manage-students.php form submissions
Edit manage-students.php to include CSRF token generation and validation
Restrict Access
allLimit access to admin panel to trusted IP addresses only
Add IP whitelisting to .htaccess or web server configuration
🧯 If You Can't Patch
- Implement web application firewall with CSRF protection rules
- Require re-authentication for sensitive actions like account deletion
🔍 How to Verify
Check if Vulnerable:
Review manage-students.php for absence of CSRF token validation in POST requestsCheck Version:
Check system version in admin panel or readme filesVerify Fix Applied:
Test that account deletion requests fail without valid CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple account deletion requests from same session
- Unusual deletion patterns
Network Indicators:
- External referer headers in admin requests
- Suspicious redirects to admin pages
SIEM Query:
source="web_logs" AND (uri="/manage-students.php" AND method="POST" AND status="200") | stats count by src_ip, user_agent