CVE-2025-2383
Published: 17 March 2025
Summary
CVE-2025-2383 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Doctor Appointment Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2383 is a critical SQL injection vulnerability in PHPGurukul Doctor Appointment Management System 1.0. The issue resides in an unknown functionality of the file /doctor/search.php, where manipulation of the searchdata argument triggers the injection. Published on 2025-03-17T16:15:27.600, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs-74 and CWE-89.
Remote attackers require only network access and no authentication or user interaction to exploit this vulnerability with low attack complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as partial data exposure, modification, or disruption via injected SQL payloads.
Advisories and additional details are documented in references including https://github.com/aionman/cve/issues/6, https://phpgurukul.com/, https://vuldb.com/?ctiid.299882, https://vuldb.com/?id.299882, and https://vuldb.com/?submit.515913. The exploit has been publicly disclosed and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6543
Vulnerability details
A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The…
more
attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in a public-facing web application (/doctor/search.php) enables initial access via exploitation of public-facing applications (T1190) and facilitates collection of data from databases (T1213.006) through arbitrary SQL query manipulation, data leakage, and tampering.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of information inputs like the searchdata parameter to block SQL injection payloads before they reach the database.
SI-2 requires identification, prioritization, and remediation of flaws such as the SQL injection in /doctor/search.php to eliminate the vulnerability.
RA-5 employs vulnerability scanning to identify SQL injection issues like CVE-2025-2383 in the Doctor Appointment Management System.