Cyber Posture

CVE-2025-25389

CriticalPublic PoC

Published: 13 February 2025

Published
13 February 2025
Modified
28 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0215 84.3th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-25389, published on 2025-02-13, is a SQL injection vulnerability (CWE-89) affecting the /admin/forgot-password.php component in Phpgurukul Land Record System version 1.0. The flaw allows remote attackers to execute arbitrary code by injecting malicious payloads via the "contactno" POST request parameter. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network by submitting a crafted POST request to the affected endpoint with a specially manipulated "contactno" parameter. Successful exploitation grants arbitrary code execution on the vulnerable server, enabling attackers to potentially read sensitive data, modify records, or disrupt system operations.

A technical writeup is available at https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20forget.pdf, which documents the vulnerability discovery and proof-of-concept details. No official vendor advisories or patches are referenced in the provided information.

Details

CWE(s)
CWE-89

Affected Products

phpgurukul
land record system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web app (/admin/forgot-password.php) enables remote exploitation for initial access (T1190) and facilitates arbitrary database queries for data collection (T1213.006).

References