Cyber Resilience

CVE-2025-28072

HighPublic PoC

Published: 16 April 2025

Published
16 April 2025
Modified
28 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0139 80.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28072 is a high-severity Path Traversal (CWE-22) vulnerability in Phpgurukul Pre-School Enrollment System. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

PHPGurukul Pre-School Enrollment System contains a directory traversal vulnerability, tracked as CVE-2025-28072 and assigned CWE-22, that affects the manage-teachers.php component. The flaw received a CVSS 3.1 base score of 7.5, reflecting network attackability without authentication or user interaction and resulting in high confidentiality impact.

An unauthenticated remote attacker can supply crafted path sequences to the affected script and retrieve arbitrary files from the underlying server filesystem, exposing sensitive configuration or data while leaving integrity and availability untouched. The single provided reference is a GitHub repository containing a technical description of the issue.

EPSS scores remain low, moving only from a current value of 0.0139 to a recorded peak of 0.0190, indicating limited observed exploitation interest to date.

EU & UK References

Vulnerability details

PHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
Why these techniques?

Directory traversal in public-facing PHP web app (manage-teachers.php) enables exploitation of public-facing application (T1190), facilitates file/directory discovery (T1083), data collection from local system (T1005), and credential access from files such as /etc/passwd or configs (T1552.001, T1003.008).

Affected Assets

phpgurukul
pre-school enrollment system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References