CVE-2025-2372
Published: 17 March 2025
Summary
CVE-2025-2372 is a high-severity Injection (CWE-74) vulnerability in Phpgurukul Human Metapneumovirus Testing Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by validating and sanitizing the 'username' argument in /password-recovery.php before database queries.
Requires timely identification, reporting, and remediation of the specific SQL injection flaw documented in CVE-2025-2372.
Restricts the 'username' input to safe formats, lengths, and characters to block SQL injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in public-facing web application password recovery page enables exploitation of public-facing application (T1190) and collection of data from backend databases (T1213.006).
NVD Description
A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the file /password-recovery.php of the component Password Recovery Page. The manipulation of the argument username leads to sql…
more
injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2372 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in PHPGurukul Human Metapneumovirus Testing Management System version 1.0. The flaw affects the Password Recovery Page component, specifically the file /password-recovery.php, where manipulation of the 'username' argument enables SQL injection. Published on 2025-03-17, it carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is remotely exploitable by unauthenticated attackers with low attack complexity and no user interaction required. Exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption within the application's database.
Advisories referenced in VULDB entries (ctiid.299871, id.299871, submit.515389), a GitHub issue at SECWG/cve/issues/5, and the vendor site phpgurukul.com document the issue, with the exploit publicly disclosed and available for use. No specific patch or mitigation details are outlined in the core disclosure.
Details
- CWE(s)