CVE-2025-25388
Published: 13 February 2025
Summary
CVE-2025-25388 is a critical-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
A SQL injection vulnerability exists in PHPGurukul Land Record System v1.0 within the /admin/edit-propertytype.php script. The flaw, tracked as CVE-2025-25388 and assigned CWE-89, permits unsanitized input from the editid GET parameter to be passed directly into SQL queries, enabling attackers to manipulate database operations. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.
Remote, unauthenticated attackers can supply crafted editid values to execute arbitrary SQL commands against the underlying database. Successful exploitation can lead to data exfiltration, modification, or deletion, and under certain database configurations may extend to operating-system command execution as indicated by the advisory description.
The single available reference is a public technical write-up hosted on GitHub that demonstrates the injection vector; no vendor advisory or patch information is referenced in the provided data. EPSS scores remain low, with a recorded peak of 0.0305 and a current value of 0.0215.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4118
Vulnerability details
A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the editid GET request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application (/admin/edit-propertytype.php) enables remote attackers to execute arbitrary code via editid parameter, directly facilitating exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation of untrusted inputs like the editid GET parameter to block SQL injection payloads before they reach the database.
Requires timely remediation of identified flaws, such as patching the SQL injection vulnerability in /admin/edit-propertytype.php.
Implements vulnerability scanning that detects SQL injection issues like CVE-2025-25388 in web applications and drives their remediation.