Cyber Resilience

CVE-2025-25389

CriticalPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
28 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0215 84.6th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25389 is a critical-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A SQL injection vulnerability exists in the /admin/forgot-password.php endpoint of Phpgurukul Land Record System version 1.0. The flaw, tracked as CVE-2025-25389 and assigned CWE-89, is triggered through the contactno POST parameter and carries a CVSS 3.1 base score of 9.8.

Unauthenticated remote attackers can supply crafted input over the network to execute arbitrary SQL commands, resulting in full compromise of confidentiality, integrity, and availability of the affected application and its underlying database.

The single available reference is a technical write-up containing proof-of-concept details; no vendor advisory or patch information is provided in the supplied sources. The associated EPSS score remains low, with a current value of 0.0215 and a peak of 0.0305.

EU & UK References

Vulnerability details

A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/admin/forgot-password.php) enables remote exploitation for initial access (T1190) and facilitates arbitrary database queries for data collection (T1213.006).

CVEs Like This One

CVE-2025-25355Same product: Phpgurukul Land Record System
CVE-2025-25356Same product: Phpgurukul Land Record System
CVE-2025-25354Same product: Phpgurukul Land Record System
CVE-2025-25357Same product: Phpgurukul Land Record System
CVE-2025-25352Same product: Phpgurukul Land Record System
CVE-2025-25387Same product: Phpgurukul Land Record System
CVE-2025-25388Same product: Phpgurukul Land Record System
CVE-2024-57687Same product: Phpgurukul Land Record System
CVE-2024-57686Same product: Phpgurukul Land Record System
CVE-2025-56074Same vendor: Phpgurukul

Affected Assets

phpgurukul
land record system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection by requiring validation of untrusted inputs like the contactno POST parameter before incorporation into SQL queries.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of identified flaws such as this SQL injection vulnerability through testing and patching.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Facilitates detection of SQL injection vulnerabilities like CVE-2025-25389 through regular vulnerability scanning.

References