Cyber Resilience

CVE-2025-26156

HighPublic PoC

Published: 14 February 2025

Published
14 February 2025
Modified
02 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0268 86.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26156 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Online Shopping Portal Project. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal v2.1 within the /shopping/track-orders.php script. The flaw, tracked as CVE-2025-26156 and assigned CWE-89, allows unsanitized input from the orderid POST parameter to reach the database, enabling arbitrary SQL execution. The issue carries a CVSS 3.1 score of 8.8.

Remote attackers who can authenticate with low privileges may submit crafted orderid values over the network to read, modify, or delete database contents and potentially execute code on the server, resulting in full compromise of confidentiality, integrity, and availability.

The two provided references point to the same GitHub repository containing exploit details but do not include vendor advisories or patch information. The associated EPSS score remains low, with a current value of 0.0268 and a peak of 0.0398.

EU & UK References

Vulnerability details

A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability in public-facing web application (PHPGurukul Online Shopping Portal) enables remote arbitrary code execution, directly facilitating T1190: Exploit Public-Facing Application.

CVEs Like This One

CVE-2025-25354Same vendor: Phpgurukul
CVE-2025-25357Same vendor: Phpgurukul
CVE-2025-70892Same vendor: Phpgurukul
CVE-2025-25352Same vendor: Phpgurukul
CVE-2025-25387Same vendor: Phpgurukul
CVE-2025-69991Same vendor: Phpgurukul
CVE-2025-25388Same vendor: Phpgurukul
CVE-2025-2683Same vendor: Phpgurukul
CVE-2025-7482Same vendor: Phpgurukul
CVE-2025-7164Same vendor: Phpgurukul

Affected Assets

phpgurukul
online shopping portal project
2.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection in the orderid POST parameter by validating and sanitizing untrusted inputs to the track-orders.php endpoint.

SI-2 Flaw Remediation good match
prevent

Remediates the specific SQL injection flaw in PHPGurukul Online Shopping Portal v2.1 through timely patching or code correction.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Detects the SQL injection vulnerability via regular scanning of the application, enabling proactive remediation.

References