CVE-2025-7160
Published: 08 July 2025
Summary
CVE-2025-7160 is a medium-severity Injection (CWE-74) vulnerability in Phpgurukul Zoo Management System. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical SQL injection vulnerability has been identified in PHPGurukul Zoo Management System version 2.1, residing in an unknown portion of the /admin/index.php file. The flaw stems from improper handling of the Username parameter, which can be manipulated to inject arbitrary SQL commands. The issue is tracked under CWE-74 and CWE-89 and carries a CVSS 4.0 score of 5.5 reflecting network-accessible attack vectors with low complexity.
Remote unauthenticated attackers can exploit the weakness to execute crafted SQL statements against the backend database. Successful exploitation may allow limited read, write, and delete operations on database contents, though the precise impact depends on database privileges and application configuration. Public exploit code has already been disclosed, enabling straightforward reproduction of the attack.
The associated EPSS score remains flat at 0.0313 with no material increase since disclosure, indicating limited observed exploitation interest to date. No official vendor patch or mitigation guidance is referenced in the available disclosures.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20389
Vulnerability details
A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Validates query inputs to prevent SQL syntax or command manipulation.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.