CVE-2025-1855
Published: 03 March 2025
Summary
CVE-2025-1855 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Online Shopping Portal. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1855 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Online Shopping Portal 2.1. The issue affects an unknown functionality in the file /product-details.php, where manipulation of the arguments quality, price, value, name, summary, or review enables SQL injection.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and can be exploited remotely. Attackers with low privileges, such as authenticated users, can leverage it to achieve low impacts on confidentiality, integrity, and availability via SQL injection.
Advisories and references, including a GitHub code audit PDF at https://github.com/panghuanjie/Code-audits/blob/main/PHPGurukul/PHPGurukul%20Online%20Shopping%20Portal%20v2.1%20SQL%20Injection3%20.pdf, the vendor site at https://phpgurukul.com/, and VULDB entries at https://vuldb.com/?ctiid.298123, https://vuldb.com/?id.298123, and https://vuldb.com/?submit.506066, detail the issue. The exploit has been disclosed publicly and may be used, with no specific patches mentioned in the available information.
The public disclosure of the exploit increases the risk of real-world exploitation against unpatched instances of PHPGurukul Online Shopping Portal 2.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5809
Vulnerability details
A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /product-details.php. The manipulation of the argument quality/price/value/name/summary/review leads to sql injection. The attack…
more
can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing /product-details.php enables exploitation of public-facing web applications (T1190), abuse of server software components via arbitrary SQL execution (T1505), and data collection from backend databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by validating and sanitizing untrusted inputs like quality, price, value, name, summary, and review before incorporation into SQL queries in /product-details.php.
SI-2 mandates timely flaw remediation, including patching or fixing the SQL injection vulnerability in PHPGurukul Online Shopping Portal 2.1 to eliminate the root cause.
RA-5 requires vulnerability scanning that would identify the SQL injection flaw in /product-details.php, enabling proactive mitigation before exploitation.