CVE-2025-2058
Published: 07 March 2025
Description
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Security Summary
CVE-2025-2058 is a critical SQL injection vulnerability affecting PHPGurukul Emergency Ambulance Hiring Portal version 1.0. The flaw resides in an unknown functionality of the file /admin/search.php, where manipulation of the searchdata argument triggers the injection. It is associated with CWEs-74 and CWE-89 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only network access and low complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection techniques.
Advisories and details are available via VulDB entries (ctiid.298813, id.298813, submit.514462), a GitHub issue at https://github.com/12T40910/CVE/issues/4, and the vendor site at https://phpgurukul.com/. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Unauthenticated SQL injection in public-facing web app (/admin/search.php) enables initial access via exploitation of public-facing application (T1190), data collection from databases (T1213.006), and abuse of server software components per advisory mapping (T1505).