Cyber Posture

CVE-2025-2628

MediumPublic PoC

Published: 22 March 2025

Published
22 March 2025
Modified
02 April 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.1th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Security Summary

CVE-2025-2628 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Art Gallery Management System version 1.1, published on 2025-03-22. The flaw resides in an unknown function within the file /art-enquiry.php, where manipulation of the 'eid' argument enables SQL injection.

The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L), but no user interaction (UI:N). Per its CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), attackers can achieve low impacts on confidentiality, integrity, and availability, such as limited data exposure, modification, or denial of service.

Advisories and details are referenced at https://github.com/ydnd/cve/issues/3, https://phpgurukul.com/, https://vuldb.com/?ctiid.300630, https://vuldb.com/?id.300630, and https://vuldb.com/?submit.519615. The exploit has been publicly disclosed and may be used, though no specific patch or mitigation steps are outlined in the CVE description.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
art gallery management system
1.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/art-enquiry.php) enables exploitation of public-facing applications (T1190), data collection from databases (T1213.006), and abuse of server software components (T1505, as noted in advisory).

References