Cyber Resilience

CVE-2025-45947

CriticalPublic PoCRCE

Published: 28 April 2025

Published
28 April 2025
Modified
30 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-45947 is a critical-severity Code Injection (CWE-94) vulnerability in Phpgurukul Online Banquet Booking System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2025-45947 is a remote code execution vulnerability in phpgurukul Online Banquet Booking System version 1.2. The flaw resides in the My Account - Change Password component, specifically the /obbs/change-password.php file, and is classified under CWE-94 as improper control of code generation. It carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction.

Unauthenticated attackers can supply crafted input to the affected password-change endpoint and achieve arbitrary code execution on the server, granting full control over the application and underlying system. The attack requires only a network connection to the web application and succeeds against the default configuration.

Public references include the vendor site phpgurukul.com and a GitHub repository containing a detailed proof-of-concept, but no official patch or mitigation guidance is provided in the available sources. The EPSS score rose from a low baseline to a peak of 0.0130 before settling at 0.0041, indicating measurable post-disclosure exploitation interest that warrants renewed attention.

EU & UK References

Vulnerability details

An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE describes arbitrary code execution in a public-facing web application (phpgurukul Online Banquet Booking System via /obbs/change-password.php), directly enabling exploitation of public-facing applications.

Affected Assets

phpgurukul
online banquet booking system
1.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

addresses: CWE-94

Validates inputs used in dynamic code generation to block injected directives.

addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.

References