CVE-2025-25354
Published: 13 February 2025
Summary
CVE-2025-25354 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the contactnumber POST parameter before database queries.
SI-2 remediates the specific SQL injection flaw in /admin/admin-profile.php through timely identification, correction, and testing of the vulnerability.
SI-9 restricts the types, amounts, and sources of inputs such as contactnumber to block malicious SQL payloads at system boundaries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application (/admin/admin-profile.php) enables remote arbitrary SQL code execution, mapped to exploitation of public-facing applications.
NVD Description
A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactnumber POST request parameter.
Deeper analysisAI
CVE-2025-25354 is a SQL injection vulnerability in the /admin/admin-profile.php component of PHPGurukul Land Record System version 1.0. The flaw allows remote attackers to execute arbitrary code by injecting malicious payloads via the contactnumber POST request parameter. It is classified under CWE-89 and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Attackers with high privileges, such as authenticated administrators, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation enables arbitrary code execution, resulting in high impacts on confidentiality, integrity, and availability within the application's scope.
References for this CVE include GitHub writeups at https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20contact.pdf, which document the SQL injection affecting the contactnumber parameter in PHPGurukul Land Record System. No specific patches or mitigation steps are detailed in the CVE description.
Details
- CWE(s)