Cyber Resilience

CVE-2025-29641

HighPublic PoC

Published: 21 March 2025

Published
21 March 2025
Modified
01 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 12.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29641 is a high-severity SQL Injection (CWE-89) vulnerability in Anujk305 Vehicle Record Management System. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-29641, published on 2025-03-21, is a SQL injection vulnerability (CWE-89) in Phpgurukul Vehicle Record Management System version 1.0. The flaw resides in the /index.php endpoint via the 'searchinputdata' parameter, allowing malicious SQL payloads to be injected into database queries.

The vulnerability has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity. An unauthenticated remote attacker with network access can exploit it with low attack complexity and no user interaction. Exploitation enables limited impacts: partial disclosure of confidential information, limited data modification, and limited denial-of-service effects.

Mitigation details are available in the referenced advisory at https://github.com/Pei4AN/CVE/issues/5.

EU & UK References

Vulnerability details

Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/index.php) directly enables remote unauthenticated exploitation of the application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

anujk305
vehicle record management system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Enforces validation of user inputs like the 'searchinputdata' parameter to block malicious SQL payloads and prevent injection.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of the SQL injection flaw in the Vehicle Record Management System.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection with web application firewalls monitors and blocks SQL injection attempts at network interfaces.

References