CVE-2025-2649
Published: 23 March 2025
Summary
CVE-2025-2649 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Doctor Appointment Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical SQL injection vulnerability, designated CVE-2025-2649, affects the PHPGurukul Doctor Appointment Management System version 1.0. The flaw resides in unknown code within the /check-appointment.php file, where the 'searchdata' argument can be manipulated to trigger the injection. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-23.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation via the 'searchdata' parameter enables SQL injection, potentially allowing limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption depending on the database configuration.
Advisories and references, including those from VulDB (ctiid.300664, id.300664, submit.519780) and a GitHub issue at liuhao2638/cve/issues/12, document the issue, while the vendor site phpgurukul.com provides context on the affected software. No specific patches or mitigations are detailed in the available information.
The exploit has been publicly disclosed, increasing the risk of widespread use against unpatched instances of this system.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7311
Vulnerability details
A vulnerability classified as critical was found in PHPGurukul Doctor Appointment Management System 1.0. This vulnerability affects unknown code of the file /check-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/check-appointment.php) enables exploitation of public-facing application (T1190) and unauthorized database access, modification, or deletion (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the 'searchdata' input parameter in /check-appointment.php before database queries.
Remediates the specific SQL injection flaw through timely patching or code correction in the affected PHPGurukul system.
Identifies the SQL injection vulnerability via regular scanning, enabling proactive remediation before exploitation.