Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-25965 — CVE-2025-25965 is a newly discovered CSRF vulnerability in the Phpgurukul Online Banquet Booking System v1.2, allowing remote attackers to change a user’s email address without their consent by exploiting an authenticated session. | Kitploit
Tools/GitHubGitHub/sudo-sakib/cve-2025-25965
Vulnerability AnalysisWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubsudo-sakib/cve-2025-25965

CVE-2025-25965

CVE-2025-25965 is a newly discovered CSRF vulnerability in the Phpgurukul Online Banquet Booking System v1.2, allowing remote attackers to change a user’s email address without their consent by exploiting an authenticated session.

View Repository
1 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-25965: Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.2

Introduction

Cross-Site Request Forgery (CSRF) remains one of the most overlooked yet dangerous vulnerabilities affecting web applications today. CVE-2025-25965 is a newly discovered CSRF vulnerability in the Phpgurukul Online Banquet Booking System v1.2, allowing remote attackers to change a user’s email address without their consent by exploiting an authenticated session.

Vulnerability Overview

CVE ID: CVE-2025-25965

Vulnerability Type: Cross-Site Request Forgery (CSRF)

Affected Product: Online Banquet Booking System - v1.2

Affected Component: User Profile Update Functionality (profile.php)

Impact: Unauthorized Account Modifications

Attack Type: Remote

Severity: High

Discoverer: Sakib Shaikh

Steps to Reproduce

To demonstrate the impact, follow these step-by-step instructions:

  1. Install and configure the Online Banquet Booking System v1.2 on a local server.

  2. Log in with provided credentials by PHPGurukul.

  3. Navigate to user profile section

  4. Change email address and Intercept that request in the Burp Suite.

  5. Notice there is no CSRF Token.

  6. Generate a CSRF Payload and open that on Incognito mode.

  7. Notice that your email gets changed.

Root Cause Analysis

The vulnerability occurs because the application does not implement CSRF protection mechanisms, such as CSRF tokens, in the profile update functionality. This allows an attacker to trick an authenticated user into unknowingly executing a malicious request that changes their email address.

References

https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/

https://owasp.org/www-community/attacks/csrf

Download Tool