CVE-2025-25352
Published: 13 February 2025
Summary
CVE-2025-25352 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A SQL Injection vulnerability exists in the /admin/aboutus.php component of PHPGurukul Land Record System v1.0. The issue, assigned CVE-2025-25352, is triggered when the pagetitle POST parameter is processed without adequate sanitization, allowing an attacker to inject arbitrary SQL statements.
An authenticated remote attacker with administrative access can supply crafted input via the pagetitle parameter to execute malicious SQL queries. Successful exploitation can result in full read, write, and delete access to the database along with potential escalation to arbitrary code execution on the host.
The two provided references point to the same public proof-of-concept write-up and contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score remains flat at 0.0197 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4112
Vulnerability details
A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the pagetitle POST request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL Injection vulnerability in public-facing web application (/admin/aboutus.php) allows remote arbitrary code execution, enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by enforcing input validation on parameters like pagetitle in /admin/aboutus.php.
SI-2 remediates the specific SQL injection flaw in PHPGurukul Land Record System v1.0 by identifying and correcting the vulnerable code.
RA-5 detects the SQL injection vulnerability through vulnerability scanning tools that identify injectable parameters like pagetitle.