Cyber Posture

CVE-2025-25355

HighPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
14 February 2025
KEV Added
—
Patch
—
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0197 83.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-25355 is a SQL injection vulnerability in the /admin/bwdates-reports-details.php component of PHPGurukul Land Record System version 1.0. The flaw allows remote attackers to execute arbitrary code by injecting malicious payloads into the 'fromdate' POST request parameter. Published on 2025-02-13, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-89.

Exploitation targets users with high privileges, such as authenticated administrators, who can submit crafted POST requests to the vulnerable endpoint over the network. The attack requires low complexity and no user interaction, enabling attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.

References point to GitHub writeups detailing the SQL injection via the 'fromdate' parameter, including proof-of-concept information in PDF format. No specific patch or mitigation details are outlined in the provided sources.

Details

CWE(s)
CWE-89

Affected Products

phpgurukul
land record system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web application (/admin/bwdates-reports-details.php) enables remote exploitation (T1190) and arbitrary SQL query execution for database data collection (T1213.006).

References