Cyber Posture

CVE-2025-2382

HighPublic PoC

Published: 17 March 2025

Published
17 March 2025
Modified
26 May 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0013 32.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Security Summary

CVE-2025-2382 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting PHPGurukul Online Banquet Booking System 1.0. The flaw resides in an unknown functionality of the file /admin/booking-search.php, where manipulation of the 'searchdata' argument triggers the injection. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-17T15:15:46.590.

The vulnerability is remotely exploitable by unauthenticated attackers with low attack complexity and no requirement for user interaction. Exploitation via SQL injection can result in limited impacts to confidentiality, integrity, and availability, potentially allowing unauthorized data access, modification, or disruption depending on the database backend.

Advisories referenced in VulDB (ctiid.299881, id.299881, submit.515911) and a GitHub issue (aionman/cve/issues/5) document the issue, with the vendor site at phpgurukul.com. The exploit has been publicly disclosed and may be used by attackers.

The vulnerability's public exploit availability heightens risk for exposed instances of this booking system.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
online banquet booking system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Why these techniques?

SQL injection in unauthenticated public-facing web application (/admin/booking-search.php) enables remote exploitation of public-facing application (T1190) and server software component (T1505).

References