CVE-2025-25389
Published: 13 February 2025
Summary
CVE-2025-25389 is a critical-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of untrusted inputs like the contactno POST parameter before incorporation into SQL queries.
Requires timely remediation of identified flaws such as this SQL injection vulnerability through testing and patching.
Facilitates detection of SQL injection vulnerabilities like CVE-2025-25389 through regular vulnerability scanning.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/admin/forgot-password.php) enables remote exploitation for initial access (T1190) and facilitates arbitrary database queries for data collection (T1213.006).
NVD Description
A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.
Deeper analysisAI
CVE-2025-25389, published on 2025-02-13, is a SQL injection vulnerability (CWE-89) affecting the /admin/forgot-password.php component in Phpgurukul Land Record System version 1.0. The flaw allows remote attackers to execute arbitrary code by injecting malicious payloads via the "contactno" POST request parameter. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.
Remote, unauthenticated attackers can exploit this vulnerability over the network by submitting a crafted POST request to the affected endpoint with a specially manipulated "contactno" parameter. Successful exploitation grants arbitrary code execution on the vulnerable server, enabling attackers to potentially read sensitive data, modify records, or disrupt system operations.
A technical writeup is available at https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20forget.pdf, which documents the vulnerability discovery and proof-of-concept details. No official vendor advisories or patches are referenced in the provided information.
Details
- CWE(s)