CVE-2025-2740
Published: 25 March 2025
Summary
CVE-2025-2740 is a high-severity Injection (CWE-74) vulnerability in Phpgurukul Old Age Home Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing the pagetitle parameter before its use in database queries.
Remediates the specific SQL injection flaw in /admin/eligibility.php through timely identification, reporting, and correction.
Boundary protection with web application firewalls monitors and blocks remote SQL injection payloads targeting the pagetitle argument.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing web app (/admin/eligibility.php) enables exploitation of public-facing applications (T1190), data collection from databases via queries (T1213.006), and stored data manipulation/tampering (T1565.001).
NVD Description
A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/eligibility.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2740 is a critical SQL injection vulnerability in PHPGurukul Old Age Home Management System 1.0. The issue affects an unknown function in the file /admin/eligibility.php, where manipulation of the pagetitle argument enables the injection. It is remotely exploitable and has been assigned a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with associated CWEs-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
Remote attackers without authentication prerequisites can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via injected SQL payloads targeting the pagetitle parameter.
Advisories referenced in VulDB entries (ctiid.300762, id.300762, submit.524733) and a GitHub issue (guimo3/cve/issues/1) document the vulnerability, while the vendor site phpgurukul.com provides context on the affected software. No specific patches or mitigations are detailed in the available information.
The exploit has been publicly disclosed and may be actively used, as noted in the CVE description published on 2025-03-25.
Details
- CWE(s)