CVE-2025-25357
Published: 13 February 2025
Summary
CVE-2025-25357 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
A SQL injection vulnerability exists in the /admin/contactus.php endpoint of PHPGurukul Land Record System version 1.0. The flaw, tracked as CVE-2025-25357 and assigned CWE-89, permits unsanitized input from the email POST parameter to be passed directly into database queries, enabling manipulation of SQL statements.
An attacker with administrative credentials can supply crafted input through the contact-us form to execute arbitrary SQL commands. Given the CVSS 7.2 rating reflecting network-reachable, low-complexity access with high privileges, successful exploitation can result in full read, write, and delete operations on the underlying database, potentially leading to code execution or complete system compromise.
Public references consist of technical write-ups demonstrating the injection vector but contain no official vendor advisory, patch details, or mitigation guidance. The associated EPSS score remains low and unchanged at 0.0265 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4116
Vulnerability details
A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL Injection vulnerability in public-facing web application (/admin/contactus.php) enables remote attackers to execute arbitrary code.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the email POST parameter in /admin/contactus.php before database queries.
Requires timely identification, reporting, and correction of the specific SQL injection flaw in PHPGurukul Land Record System v1.0.
Scans for vulnerabilities like this SQL injection in the admin contactus.php component and remediates based on risk assessment.