CVE-2025-1954
Published: 04 March 2025
Summary
CVE-2025-1954 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Human Metapneumovirus Testing Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1954 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting PHPGurukul Human Metapneumovirus Testing Management System version 1.0. The flaw resides in an unknown functionality of the /login.php file, where manipulation of the username argument enables SQL injection.
Attackers can exploit this vulnerability remotely without authentication or user interaction, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Unauthenticated remote actors require low complexity to launch the attack, potentially achieving limited impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (ctiid.298555, id.298555, submit.510360) and a GitHub disclosure document the issue, including exploit details. The vendor site at phpgurukul.com is listed among references for further information on potential mitigations or patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7451
Vulnerability details
A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument username leads to sql injection.…
more
The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing /login.php endpoint enables initial access via exploitation of public-facing applications (T1190), credential access by dumping authentication data from the database (T1212), and collection of data from information repositories/databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of the username input in /login.php to reject malicious payloads.
SI-2 mandates identification, reporting, and correction of flaws like the SQL injection vulnerability in /login.php.
RA-5 requires vulnerability scanning that would identify the SQL injection in /login.php and trigger remediation.