CVE-2025-2648
Published: 23 March 2025
Summary
CVE-2025-2648 is a high-severity Injection (CWE-74) vulnerability in Phpgurukul Art Gallery Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates information input validation, directly preventing SQL injection by sanitizing and validating the 'viewid' parameter before its use in database queries.
SI-2 requires timely identification, reporting, and correction of system flaws, addressing this SQL injection vulnerability through patching the affected /admin/view-enquiry-detail.php file.
RA-5 employs vulnerability scanning to detect SQL injection flaws like CVE-2025-2648 and mandates remediation, enabling proactive identification and response.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application (/admin/view-enquiry-detail.php) enables exploitation of public-facing application (T1190) and unauthorized data collection from databases (T1213.006).
NVD Description
A vulnerability classified as critical has been found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part of the file /admin/view-enquiry-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2648 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Art Gallery Management System 1.0. The flaw affects an unknown part of the file /admin/view-enquiry-detail.php, where manipulation of the 'viewid' argument enables SQL injection.
An unauthenticated remote attacker can exploit this vulnerability remotely with low attack complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation can result in limited impacts to confidentiality, integrity, and availability.
VulDB advisories (ctiid.300663, id.300663, submit.519779) detail the issue, while a GitHub repository (liuhao2638/cve/issues/11) discloses a public exploit. The vendor site phpgurukul.com is referenced, but no patches or specific mitigations are outlined in the available information.
Details
- CWE(s)