CVE-2025-25355
Published: 13 February 2025
Summary
CVE-2025-25355 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A SQL injection vulnerability exists in PHPGurukul Land Record System version 1.0 within the file /admin/bwdates-reports-details.php. The flaw, tracked as CVE-2025-25355 and assigned CWE-89, permits remote attackers to supply crafted input through the fromdate POST parameter, resulting in arbitrary code execution. The issue carries a CVSS 3.1 base score of 7.2 reflecting network attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability when successfully exploited.
An attacker with administrative credentials can send a malicious POST request to the affected endpoint and leverage the unsanitized parameter to execute arbitrary SQL commands against the backend database. This level of access enables full read, write, and modification capabilities within the application’s data store, potentially leading to complete system compromise.
No official patches or mitigation guidance appear in the referenced materials, which consist solely of third-party technical write-ups hosted on GitHub. The associated EPSS score remains low at 0.0197 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4114
Vulnerability details
A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/admin/bwdates-reports-details.php) enables remote exploitation (T1190) and arbitrary SQL query execution for database data collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the 'fromdate' POST parameter to block SQL injection payloads before they reach the database.
Mandates timely identification, reporting, and remediation of flaws such as this SQL injection vulnerability through patching or secure coding fixes.
Provides boundary protection via web application firewalls or proxies to inspect and filter malicious POST requests targeting SQL injection in admin endpoints.