CVE-2025-70899

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-70899
PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious webpage.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md Exploit Mitigation Third Party Advisory
https://phpgurukul.com/online-course-registration-free-download/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:phpgurukul:online_course_registration:3.1:*:*:*:*:*:*:*
History

17 Jun 2026, 10:03

Type Values Removed Values Added
Summary
  • (es) PHPgurukul Online Course Registration v3.1 carece de protección contra falsificación de petición en sitios cruzados (CSRF) en todos los formularios administrativos. Un atacante puede realizar acciones no autorizadas en nombre de administradores autenticados al engañarlos para que visiten una página web maliciosa.

02 Feb 2026, 20:01

Type Values Removed Values Added
First Time Phpgurukul online Course Registration
Phpgurukul
References () https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md - () https://github.com/mathavamoorthi/CVE-2025-70899/blob/main/Missing_CSRF_protection_poc.md - Exploit, Mitigation, Third Party Advisory
References () https://phpgurukul.com/online-course-registration-free-download/ - () https://phpgurukul.com/online-course-registration-free-download/ - Product
CPE cpe:2.3:a:phpgurukul:online_course_registration:3.1:*:*:*:*:*:*:*

23 Jan 2026, 17:16

Type Values Removed Values Added
CWE CWE-352
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

22 Jan 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 17:16

Updated : 2026-06-17 10:03

NVD link : CVE-2025-70899

Mitre link : CVE-2025-70899

CVE.ORG link : CVE-2025-70899

JSON object : View

Products Affected

phpgurukul

  • online_course_registration
CWE
CWE-352

Cross-Site Request Forgery (CSRF)