LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25411: Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete...

Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-25411 describes a CSRF flaw in Projectworlds Online Examination System 1.0 that can let an attacker cause deletion of an existing user. Business impact is account loss, disruption, and possible administrative cleanup burden. The public record does not provide a CVSS score, vendor advisory, or confirmed patch details.

Executive priority

Treat as a targeted operational risk, not a confirmed mass-exploitation emergency. Prioritize if the application supports exams, student records, or staff administration, because user deletion can disrupt service and trust.

Technical view

The CVE description says Projectworlds Online Examination System 1.0 is vulnerable to cross-site request forgery affecting user deletion. Evidence indicates a remote attacker can trigger deletion through a victim’s authenticated browser context. Available sources do not define exact endpoint behavior, required privileges, CWE, CVSS, or remediation version.

Likely exposure

Exposure is limited to organizations running Projectworlds Online Examination System 1.0, especially internet-accessible PHP deployments where authenticated users or administrators can delete accounts. The source bundle does not identify broader affected versions or CPEs.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle, and no cited source confirms active exploitation. Likely exploitation depends on social engineering an authenticated user into making a state-changing request.

Researcher notes

The public data is sparse: no CVSS, CWE, affected CPE, patch version, or authoritative vendor advisory is present in the supplied bundle. Analysis should remain bounded to CSRF-driven user deletion in Projectworlds Online Examination System 1.0.

Mitigation direction

  • Check the project repository and vendor guidance for a fixed release or maintainer instructions.
  • Restrict administrative and user-management access to trusted networks or authenticated staff only.
  • If maintaining the app, require anti-CSRF protection on all state-changing user actions.
  • Review account deletion audit trails and restore improperly removed users where needed.

Validation and detection

  • Inventory whether Projectworlds Online Examination System 1.0 is deployed anywhere.
  • Confirm whether user deletion requests require a valid per-session CSRF control.
  • Review logs for unexpected or unexplained user deletion events.
  • Verify any upgrade or local fix against the affected user-management workflow.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-25411 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.