CVE-2025-2473
Published: 18 March 2025
Summary
CVE-2025-2473 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Company Visitor Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability classified as critical exists in PHPGurukul Company Visitor Management System 2.0. It resides in an unknown function of the /index.php file within the Sign In component, where improper handling of the username argument permits SQL injection. The flaw is remotely exploitable without authentication or user interaction, as reflected in its CVSS 4.0 vector and associated CWE-74 and CWE-89 entries.
An unauthenticated attacker can supply crafted input to the username field over the network to execute arbitrary SQL commands. Successful exploitation grants limited read, write, and disruption capabilities against the affected database, potentially exposing or altering visitor records and related data.
The EPSS score rose from a low baseline to a peak of 0.1548 on 2025-12-11 before receding to 0.0472, indicating increased exploitation interest after public disclosure. Public references, including a detailed report on GitHub and entries on VulDB, confirm the issue has been shared openly and may be leveraged by threat actors.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6479
Vulnerability details
A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to…
more
sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application login enables exploitation (T1190), database data collection via arbitrary queries (T1213.006), and data destruction such as dropping tables (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the username input in the Sign In component's /index.php.
Mandates identification, reporting, and correction of the specific SQL injection flaw in CVE-2025-2473.
Requires vulnerability scanning to identify SQL injection issues like this CVE and subsequent remediation.