CVE-2025-63711: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint (e.g., superadminuserdelete.php) accepts POST requests containing a userid parameter and does not enforce request origin or anti-CSRF tokens. Because the endpoint lacks proper authentication/authorization checks and CSRF protections, a remote attacker can craft a malicious page that triggers deletion when visited by an authenticated admin, resulting in arbitrary removal of user accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63711?
CVE-2025-63711 is considered a high severity vulnerability due to its potential for unauthorized user deletion actions.
How do I fix CVE-2025-63711?
To fix CVE-2025-63711, implement anti-CSRF tokens in forms and validate user actions to ensure they are performed intentionally.
Who is affected by CVE-2025-63711?
CVE-2025-63711 affects users of the SourceCodester Client Database Management System 1.0 who have administrative access.
What type of vulnerability is CVE-2025-63711?
CVE-2025-63711 is a Cross-Site Request Forgery (CSRF) vulnerability.
What action can an attacker take with CVE-2025-63711?
An attacker exploiting CVE-2025-63711 can cause an authenticated administrative user to delete other users without their consent.