The Complaint Management System built in PHP 2.0 contains a failure to sanitize the mobileno parameter in the reset-password.php script. This omission allows attackers to inject arbitrary SQL commands into the request. An attacker who succeeds could read, modify, or delete data in the underlying database, reset users’ passwords, or even gain unauthorized database access. The vulnerability is an instance of injection (CWE‑89) and could compromise confidentiality, integrity, and availability of the system’s data.

Vendor phpGurukul, Product Complaint Management System version 2.0, specifically the reset-password.php component accessed via the user/reset-password.php URL.

The CVSS score of 8.1 denotes a high severity threat, while the EPSS score of less than 1% indicates a very low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog, but the lack of a mitigation in the code means it can be exploited if an attacker can reach the reset-password endpoint. The likely attack vector is remote over the web, requiring only an unauthenticated HTTP request with a crafted mobileno value.