CVE-2025-1954
Published: 04 March 2025
Summary
CVE-2025-1954 is a high-severity Injection (CWE-74) vulnerability in Phpgurukul Human Metapneumovirus Testing Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation of the username input in /login.php to reject malicious payloads.
SI-2 mandates identification, reporting, and correction of flaws like the SQL injection vulnerability in /login.php.
RA-5 requires vulnerability scanning that would identify the SQL injection in /login.php and trigger remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing /login.php endpoint enables initial access via exploitation of public-facing applications (T1190), credential access by dumping authentication data from the database (T1212), and collection of data from information repositories/databases (T1213.006).
NVD Description
A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument username leads to sql injection.…
more
The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1954 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting PHPGurukul Human Metapneumovirus Testing Management System version 1.0. The flaw resides in an unknown functionality of the /login.php file, where manipulation of the username argument enables SQL injection.
Attackers can exploit this vulnerability remotely without authentication or user interaction, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Unauthenticated remote actors require low complexity to launch the attack, potentially achieving limited impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (ctiid.298555, id.298555, submit.510360) and a GitHub disclosure document the issue, including exploit details. The vendor site at phpgurukul.com is listed among references for further information on potential mitigations or patches.
Details
- CWE(s)