CVE-2025-2640
Published: 23 March 2025
Summary
CVE-2025-2640 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Doctor Appointment Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2640 is a critical SQL injection vulnerability in PHPGurukul Doctor Appointment Management System version 1.0. The flaw resides in the processing of the /doctor/appointment-bwdates-reports-details.php file, where the fromdate and todate parameters are vulnerable to manipulation, enabling SQL injection attacks. It is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially permitting unauthorized data access, modification, or disruption within the application's database.
Advisories referenced in VulDB entries (ctiid.300641, id.300641, submit.519644) and a GitHub issue detail the vulnerability and note that the exploit has been publicly disclosed, increasing the risk of active use. The vendor site at phpgurukul.com provides context on the affected software, but no specific patches or mitigations are outlined in the available references.
The public disclosure of the exploit heightens the urgency for organizations using this system to review and harden input validation on the affected endpoints.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7306
Vulnerability details
A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /doctor/appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing web application (/doctor/appointment-bwdates-reports-details.php) enables exploitation of public-facing apps (T1190), arbitrary SQL command execution via server software component (T1505), and data collection from databases (T1213.006) including enumeration and leakage.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the vulnerable fromdate and todate parameters before incorporation into SQL queries.
Mandates identification, reporting, and correction of the specific SQL injection flaw in /doctor/appointment-bwdates-reports-details.php.
Requires vulnerability scanning that would identify the SQL injection vulnerability in the affected endpoint for timely remediation.