CVE-2025-25387
Published: 13 February 2025
Summary
CVE-2025-25387 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A SQL injection vulnerability exists in the /admin/manage-propertytype.php endpoint of PHPGurukul Land Record System v1.0. The flaw is triggered when the application processes an unsanitized propertytype POST parameter, allowing an attacker to inject arbitrary SQL statements. The issue is tracked as CVE-2025-25387 with a CVSS 3.1 score of 7.2 and is classified under CWE-89.
An authenticated user with administrative privileges can exploit the vulnerability over the network by submitting a crafted POST request to the affected script. Successful exploitation grants the ability to read, modify, or delete database contents and, under certain conditions, execute arbitrary code on the underlying server.
The associated EPSS score remains low, with a current value of 0.0197 and a peak of 0.0208, indicating limited observed exploitation interest since disclosure. Public references consist of technical write-ups hosted on GitHub that detail the injection vector but do not include vendor patches or official mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4117
Vulnerability details
A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application (/admin/manage-propertytype.php) allows remote arbitrary code execution via POST parameter, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of untrusted inputs like the propertytype POST parameter before incorporation into SQL queries.
Mandates identification, reporting, and correction of the specific SQL injection flaw in /admin/manage-propertytype.php to eliminate the vulnerability.
Boundary protection with web application firewalls can inspect and block malicious SQL injection payloads in POST requests to the vulnerable endpoint.