CSRF Vulnerability in SourceCodester Product Expiry Management System

CVE-2025-63712

What is CVE-2025-63712?

The SourceCodester Product Expiry Management System is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in its User Management module. This flaw allows remote attackers to delete arbitrary user accounts by exploiting the delete-user.php endpoint. The vulnerability arises because the module relies solely on session cookies for authentication and does not implement adequate CSRF protections, enabling attackers to send forged cross-origin GET requests that can compromise user accounts.

References