PT-2025-46162 · Sourcecodester · Client Database Management System

Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-63711

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0

Description A Cross-Site Request Forgery (CSRF) issue exists in the application, potentially allowing an attacker to cause an authenticated administrative user to perform actions without their consent. The application’s user deletion endpoint, such as /superadmin user delete.php, accepts POST requests containing the user id parameter. The endpoint does not enforce request origin or anti-CSRF tokens, and lacks proper authentication/authorization checks and CSRF protections. An attacker can craft a malicious page that triggers deletion when visited by an authenticated administrator, resulting in arbitrary removal of user accounts.

Recommendations Apply appropriate CSRF protections to the /superadmin user delete.php endpoint. Implement request origin validation to ensure requests originate from trusted sources. Enforce anti-CSRF tokens for all state-changing requests, including user deletion. Implement robust authentication and authorization checks to verify user permissions before allowing deletion actions.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-63711

Affected Products

Client Database Management System

References · 7

• 🔥 https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63711/README3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63711 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63711 · Vendor Advisory
• https://t.me/CVEtracker/36923 · Telegram Post
• https://sourcecodester.com/php/17514/client-database-management-system.html · Note
• https://twitter.com/CVEnew/status/1987896594528678209 · Twitter Post
• https://twitter.com/cracbot/status/1989287266213314842 · Twitter Post