Cyber Resilience

CVE-2025-25356

HighPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
14 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0265 86.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25356 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A SQL Injection vulnerability exists in the /admin/bwdates-reports-details.php endpoint of PHPGurukul Land Record System version 1.0. The flaw, tracked as CVE-2025-25356 and assigned CWE-89, is triggered through the "todate" POST request parameter and carries a CVSS 3.1 base score of 7.2.

An authenticated administrator can supply a crafted value in the affected parameter to inject arbitrary SQL statements. Successful exploitation grants the attacker the ability to execute arbitrary code on the server, resulting in full compromise of confidentiality, integrity, and availability of the application and its underlying database.

The two provided references consist of public proof-of-concept write-ups hosted on GitHub; neither document contains mitigation guidance or patch information. The associated EPSS score remains flat at 0.0265 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in web application allows remote exploitation for initial access (T1190) and arbitrary database queries for data collection (T1213.006).

CVEs Like This One

CVE-2025-25389Same product: Phpgurukul Land Record System
CVE-2025-25355Same product: Phpgurukul Land Record System
CVE-2025-25354Same product: Phpgurukul Land Record System
CVE-2025-25357Same product: Phpgurukul Land Record System
CVE-2025-25352Same product: Phpgurukul Land Record System
CVE-2025-25387Same product: Phpgurukul Land Record System
CVE-2025-25388Same product: Phpgurukul Land Record System
CVE-2024-57687Same product: Phpgurukul Land Record System
CVE-2024-57686Same product: Phpgurukul Land Record System
CVE-2025-56074Same vendor: Phpgurukul

Affected Assets

phpgurukul
land record system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection attacks by validating and sanitizing the 'todate' POST parameter before processing database queries.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and remediation of the SQL injection flaw in /admin/bwdates-reports-details.php.

SI-4 System Monitoring partial match
detect

Enables monitoring of the system for indicators of SQL injection exploitation attempts via anomalous database queries or behavior.

References