CVE-2025-2373
Published: 17 March 2025
Summary
CVE-2025-2373 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Human Metapneumovirus Testing Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2373 is a critical SQL injection vulnerability in PHPGurukul Human Metapneumovirus Testing Management System 1.0. The flaw affects unknown code in the /check_availability.php file, where manipulation of the mobnumber or employeeid arguments enables SQL injection. Published on 2025-03-17, it is associated with CWE-74 and CWE-89.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Remote attackers with low privileges can exploit it over the network with low complexity and no user interaction required, potentially achieving low impacts on confidentiality, integrity, and availability via SQL injection.
Advisories and further details, including potential mitigation guidance, are available in referenced sources such as https://github.com/SECWG/cve/issues/6, https://vuldb.com/?ctiid.299872, https://vuldb.com/?id.299872, and https://vuldb.com/?submit.515408. The exploit has been publicly disclosed and may be used.
The vendor site at https://phpgurukul.com/ provides context on the affected software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6595
Vulnerability details
A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of the file /check_availability.php. The manipulation of the argument mobnumber/employeeid leads to sql injection. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in a public-facing web application (/check_availability.php) enables exploitation of public-facing applications (T1190) and facilitates unauthorized data collection from databases via arbitrary SQL queries (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of inputs like mobnumber and employeeid in /check_availability.php to ensure they conform to expected formats and reject malicious payloads.
SI-2 mandates identification, reporting, and correction of flaws such as the SQL injection vulnerability in the PHPGurukul system's /check_availability.php file.
RA-5 requires vulnerability scanning to identify SQL injection flaws like CVE-2025-2373 in the affected application, enabling proactive remediation.