Account deletion via forged administrator requests

CSRF in PHPGurukul Student Record System 3.2 allows remote attackers to delete user accounts through an authenticated administrator. The manage-students.php deletion action accepts a state-changing request forged from attacker-controlled content without validating request authenticity. An administrator must remain authenticated and submit the forged request; successful exploitation removes accounts and interrupts access to the service.