Cyber Resilience

CVE-2025-25357

HighPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
14 February 2025
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0265 86.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25357 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

A SQL injection vulnerability exists in the /admin/contactus.php endpoint of PHPGurukul Land Record System version 1.0. The flaw, tracked as CVE-2025-25357 and assigned CWE-89, permits unsanitized input from the email POST parameter to be passed directly into database queries, enabling manipulation of SQL statements.

An attacker with administrative credentials can supply crafted input through the contact-us form to execute arbitrary SQL commands. Given the CVSS 7.2 rating reflecting network-reachable, low-complexity access with high privileges, successful exploitation can result in full read, write, and delete operations on the underlying database, potentially leading to code execution or complete system compromise.

Public references consist of technical write-ups demonstrating the injection vector but contain no official vendor advisory, patch details, or mitigation guidance. The associated EPSS score remains low and unchanged at 0.0265 with no observed increase after disclosure.

EU & UK References

Vulnerability details

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL Injection vulnerability in public-facing web application (/admin/contactus.php) enables remote attackers to execute arbitrary code.

CVEs Like This One

CVE-2025-25354Same product: Phpgurukul Land Record System
CVE-2025-25352Same product: Phpgurukul Land Record System
CVE-2025-25387Same product: Phpgurukul Land Record System
CVE-2025-25388Same product: Phpgurukul Land Record System
CVE-2025-25389Same product: Phpgurukul Land Record System
CVE-2025-25355Same product: Phpgurukul Land Record System
CVE-2025-25356Same product: Phpgurukul Land Record System
CVE-2024-57687Same product: Phpgurukul Land Record System
CVE-2024-57686Same product: Phpgurukul Land Record System
CVE-2025-26156Same vendor: Phpgurukul

Affected Assets

phpgurukul
land record system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents SQL injection by validating and sanitizing the email POST parameter in /admin/contactus.php before database queries.

prevent

Requires timely identification, reporting, and correction of the specific SQL injection flaw in PHPGurukul Land Record System v1.0.

detectrespond

Scans for vulnerabilities like this SQL injection in the admin contactus.php component and remediates based on risk assessment.

References