Cyber Resilience

CVE-2025-44185

CSRF in Mayurik Best Employee Management System 1.0

Public PoCCSRF
Published
15 May 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0019 8th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-44185 is a medium-severity CSRF (CWE-352) vulnerability in Mayurik Best Employee Management System. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CSRF vulnerability enables exploitation of a public-facing web application (T1190) to perform unauthorized account manipulation (T1098) by tricking an authenticated admin into changing their password to an attacker-controlled value.

CVEs Like This One

CVE-2025-44186Same product: Mayurik Best Employee Management System
CVE-2024-40476Same vendor: Mayurik
CVE-2025-1687Shared CWE-352
CVE-2024-11743Same vendor: Mayurik
CVE-2024-55076Shared CWE-352
CVE-2024-7161Shared CWE-352
CVE-2024-42793Shared CWE-352
CVE-2024-22643Shared CWE-352
CVE-2025-29722Shared CWE-352
CVE-2025-11051Same vendor: Mayurik

Affected Assets

mayurik
best employee management system
1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SC-23 Session Authenticity
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces that password-change requests to /admin/change_pass.php must satisfy authorization checks (e.g., anti-CSRF token or origin validation) before the action is allowed.

SC-23 Session Authenticity partial match
prevent

Requires mechanisms that bind requests to an authentic user session, blocking forged cross-site requests that lack the proper session context.

SI-10 Information Input Validation partial match
prevent

Mandates validation of all inputs to change_pass.php, including verification that the request originated from the legitimate application rather than an attacker-controlled site.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.23 Web filtering partial match
mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

A.5.7 Threat intelligence none match
none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References