Cyber Posture

CVE-2025-2646

HighPublic PoC

Published: 23 March 2025

Published
23 March 2025
Modified
02 April 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Security Summary

CVE-2025-2646 is a critical SQL injection vulnerability in PHPGurukul Art Gallery Management System version 1.0. The issue affects an unknown functionality within the file /admin/admin-profile.php, where manipulation of the 'contactnumber' argument enables the injection. It is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by unauthenticated attackers with low complexity, requiring no user interaction or privileges. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling data exfiltration, modification, or disruption through injected SQL payloads. The exploit has been publicly disclosed and is available for use, with indications that other parameters may also be vulnerable.

Advisories and additional details are available through references including a GitHub issue at https://github.com/liuhao2638/cve/issues/9, the vendor site at https://phpgurukul.com/, and VulDB entries at https://vuldb.com/?ctiid.300661, https://vuldb.com/?id.300661, and https://vuldb.com/?submit.519776. No specific patch or mitigation steps are detailed in the primary disclosure, but practitioners should review these sources for updates and apply input validation or upgrades where possible.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
art gallery management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Why these techniques?

SQL injection in public-facing web app enables initial access via exploitation of public-facing application (T1190), execution through server software component abuse with injected SQL (T1505 as cited in advisory), and data collection from databases (T1213.006).

References