Cyber Posture

CVE-2025-2378

HighPublic PoC

Published: 17 March 2025

Published
17 March 2025
Modified
02 April 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 19.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2378 is a critical SQL injection vulnerability in PHPGurukul Medical Card Generation System 1.0, affecting an unknown part of the file /download-medical-cards.php through manipulation of the searchdata argument. Published on 2025-03-17T13:15:39.513, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).

The vulnerability enables remote exploitation without authentication or user interaction, requiring low attack complexity. Attackers can manipulate the searchdata parameter to inject SQL payloads, potentially achieving low-level impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service.

Advisories referenced in VulDB entries (ctiid.299877, id.299877, submit.515822) and a GitHub issue detail the vulnerability, while the vendor site phpgurukul.com provides context on the affected software.

The exploit has been publicly disclosed and may be used by attackers.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
medical card system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

The unauthenticated SQL injection vulnerability in the public-facing /download-medical-cards.php endpoint enables remote exploitation for initial access (T1190). It also facilitates unauthorized database enumeration and data extraction as demonstrated in the POC with sqlmap (--dbs, UNION SELECT) (T1213.006).

References