CVE-2025-2640

CVE-2025-2640 is a critical SQL injection vulnerability in PHPGurukul Doctor Appointment Management System version 1.0. The flaw resides in the processing of the /doctor/appointment-bwdates-reports-details.php file, where the fromdate and todate parameters are vulnerable to manipulation, enabling SQL injection attacks. It is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).

The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially permitting unauthorized data access, modification, or disruption within the application's database.

Advisories referenced in VulDB entries (ctiid.300641, id.300641, submit.519644) and a GitHub issue detail the vulnerability and note that the exploit has been publicly disclosed, increasing the risk of active use. The vendor site at phpgurukul.com provides context on the affected software, but no specific patches or mitigations are outlined in the available references.

The public disclosure of the exploit heightens the urgency for organizations using this system to review and harden input validation on the affected endpoints.