Cyber Resilience

CVE-2025-25354

HighPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
14 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0197 83.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25354 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A SQL injection vulnerability exists in the /admin/admin-profile.php endpoint of PHPGurukul Land Record System v1.0. The flaw, tracked as CWE-89, allows unsanitized input supplied via the contactnumber POST parameter to be incorporated directly into SQL queries.

An attacker with administrative credentials can send a crafted POST request to the affected script, enabling execution of arbitrary SQL statements. Given the CVSS vector requiring high privileges and network access, successful exploitation can result in full compromise of the application database and potentially the underlying host.

The two provided references point to the same public technical write-up containing proof-of-concept details but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score remains flat at 0.0197 with no observed increase after disclosure.

EU & UK References

Vulnerability details

A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactnumber POST request parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability in public-facing web application (/admin/admin-profile.php) enables remote arbitrary SQL code execution, mapped to exploitation of public-facing applications.

CVEs Like This One

CVE-2025-25357Same product: Phpgurukul Land Record System
CVE-2025-25352Same product: Phpgurukul Land Record System
CVE-2025-25387Same product: Phpgurukul Land Record System
CVE-2025-25388Same product: Phpgurukul Land Record System
CVE-2025-25389Same product: Phpgurukul Land Record System
CVE-2025-25355Same product: Phpgurukul Land Record System
CVE-2025-25356Same product: Phpgurukul Land Record System
CVE-2024-57687Same product: Phpgurukul Land Record System
CVE-2024-57686Same product: Phpgurukul Land Record System
CVE-2025-26156Same vendor: Phpgurukul

Affected Assets

phpgurukul
land record system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the contactnumber POST parameter before database queries.

SI-2 Flaw Remediation good match
prevent

SI-2 remediates the specific SQL injection flaw in /admin/admin-profile.php through timely identification, correction, and testing of the vulnerability.

SI-9 Information Input Restrictions partial match
prevent

SI-9 restricts the types, amounts, and sources of inputs such as contactnumber to block malicious SQL payloads at system boundaries.

References