CVE-2025-2663
Published: 23 March 2025
Summary
CVE-2025-2663 is a high-severity Injection (CWE-74) vulnerability in Phpgurukul Bank Locker Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by validating the 'searchinput' argument in /search-locker-details.php to ensure only valid inputs are processed.
SI-2 requires timely remediation of the identified SQL injection flaw in PHPGurukul Bank Locker Management System 1.0.
SI-9 enforces restrictions on the 'searchinput' parameter, such as whitelisting or pattern matching, to block SQL injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability allows remote unauthenticated exploitation of a public-facing web application (T1190), enables adversary-controlled SQL execution via server software component (T1505), and facilitates unauthorized data collection from databases (T1213.006).
NVD Description
A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /search-locker-details.php. The manipulation of the argument searchinput leads to sql injection. The attack…
more
can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2663 is a critical SQL injection vulnerability in PHPGurukul Bank Locker Management System version 1.0. The issue affects an unknown functionality within the file /search-locker-details.php, where manipulation of the 'searchinput' argument enables SQL injection. Classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-23.
The vulnerability can be exploited remotely by unauthenticated attackers (PR:N) over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially enabling data exfiltration, modification, or disruption within the application's database.
Advisories and details are available through references including a GitHub issue at https://github.com/ARPANET-cyber/CVE/issues/2, the vendor site at https://phpgurukul.com/, and VulDB entries at https://vuldb.com/?ctiid.300685, https://vuldb.com/?id.300685, and https://vuldb.com/?submit.520436. The exploit has been publicly disclosed and may be in use.
Details
- CWE(s)