CVE-2025-8134
Published: 25 July 2025
Summary
CVE-2025-8134 is a low-severity Injection (CWE-74) vulnerability in Phpgurukul Bp Monitoring Management System. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-8134 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in PHPGurukul BP Monitoring Management System 1.0. The issue resides in unknown code within the file /bwdates-report-result.php, where manipulation of the fromdate and todate arguments triggers the injection. Published on 2025-07-25, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability over the network with little complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection, allowing unauthorized data access, modification, or disruption within the affected application's database.
Advisories referenced in VulDB (ctiid.317530 and id.317530) and GitHub issues (LagonGit/ReportCVE #13 and #14) document the vulnerability, while the vendor site phpgurukul.com is listed as a resource. The exploit has been publicly disclosed, heightening the risk of widespread use. No specific patches or mitigations are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22571
Vulnerability details
A vulnerability classified as critical was found in PHPGurukul BP Monitoring Management System 1.0. This vulnerability affects unknown code of the file /bwdates-report-result.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing PHP web application enables initial access via exploitation (T1190), abuse of server software components (T1505), and collection from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of fromdate/todate inputs in /bwdates-report-result.php to block SQL injection payloads.
Requires timely remediation of the known SQL injection flaw in the BP Monitoring Management System before public exploits are used.
Limits database privileges of the low-privilege account used by the web application, reducing impact of successful injection on confidentiality/integrity/availability.