CVE-2025-63712: CSRF
Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63712?
CVE-2025-63712 is considered a medium severity vulnerability due to its potential impact on user account integrity.
How does CVE-2025-63712 affect the SourceCodester Product Expiry Management System?
CVE-2025-63712 allows remote attackers to delete arbitrary user accounts through forged cross-origin GET requests.
How can I fix CVE-2025-63712?
To fix CVE-2025-63712, implement CSRF protection on the delete-user.php endpoint to validate requests properly.
What systems are impacted by CVE-2025-63712?
CVE-2025-63712 affects the User Management module of the SourceCodester Product Expiry Management System.
Is user data at risk due to CVE-2025-63712?
Yes, CVE-2025-63712 poses a risk to user data as attackers can potentially delete user accounts without authorization.