CVE-2025-2656
Published: 23 March 2025
Summary
CVE-2025-2656 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Zoo Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2656 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Zoo Management System version 2.1. The flaw resides in an unknown function of the file /admin/login.php, where manipulation of the Username argument triggers the injection.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables limited impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Advisories from VulDB (ctiid.300672, id.300672) and a GitHub issue document the vulnerability, noting that an exploit has been publicly disclosed. The vendor's site at phpgurukul.com is referenced, though specific mitigation or patch details are not outlined in the available sources.
The exploit's public disclosure increases the risk of widespread abuse against exposed instances of the affected software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7322
Vulnerability details
A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated /admin/login.php enables remote exploitation of a public-facing web application (T1190) and arbitrary database queries for data collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the Username input in /admin/login.php against malicious payloads.
Requires timely identification, reporting, and correction of the SQL injection flaw in Zoo Management System 2.1 via patching or upgrades.
Vulnerability scanning detects SQL injection issues like CVE-2025-2656 in web applications such as the Zoo Management System login function.