A Cross-Site Request Forgery vulnerability in the PHPGurukul Student Record System poses a significant risk of unauthorized administrative actions and potential service disruption.

This vulnerability is a Cross-Site Request Forgery (CSRF) located in the manage-students.php component. It allows an attacker to manipulate an authenticated administrator into executing unauthorized account deletions.

The ability for an unauthenticated attacker to trigger unauthorized administrative actions, such as deleting user accounts, leads to a direct Denial of Service for end users and loss of data integrity. With a CVSS score of 7.5, this high-severity flaw carries significant operational risk, as it compromises the availability and reliability of the student management platform.

Immediate Action: Contact the vendor, PHPGurukul, to obtain the latest security patches for the Student Record System. If a patch is unavailable, restrict administrative access to the system to trusted networks only.

Proactive Monitoring: Review web access logs for suspicious requests originating from unauthorized sources targeting the manage-students.php endpoint. Monitor for unexpected spikes in account deletion activity.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF protection rules to inspect incoming requests and block those lacking valid anti-forgery tokens.

Public Exploit Available: Yes, a published Proof-of-Concept exists via the researcher disclosure on GitHub.

Given the availability of a public proof-of-concept and the potential for disruptive administrative abuse, organizations using PHPGurukul Student Record System v3.2 must prioritize this issue. Administrators should ensure that all sessions are properly managed and apply any available vendor updates immediately upon release to prevent unauthorized account management.