Cyber Posture

CVE-2025-2473

HighPublic PoC

Published: 18 March 2025

Published
18 March 2025
Modified
21 May 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0592 90.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

Security Summary

CVE-2025-2473 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Company Visitor Management System 2.0. The flaw resides in an unknown functionality of the /index.php file within the Sign In component, where manipulation of the username argument triggers the injection. Published on 2025-03-18, it carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL queries.

Advisories provide further details via VulDB entries (ctiid.299966, id.299966, submit.517266) and a GitHub vulnerability report (l8BL/vul_report/issues/2), with the vendor site at phpgurukul.com. The exploit has been publicly disclosed and may be used by attackers.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
company visitor management system
2.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Why these techniques?

SQL injection in public-facing web application login enables exploitation (T1190), database data collection via arbitrary queries (T1213.006), and data destruction such as dropping tables (T1485).

References