Cyber Posture

CVE-2025-2647

HighPublic PoC

Published: 23 March 2025

Published
23 March 2025
Modified
27 March 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2647 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting PHPGurukul Art Gallery Management System version 1.0. The flaw resides in unknown functionality of the /search.php file, where manipulation of the Search argument enables SQL injection. Published on 2025-03-23, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by unauthenticated attackers requiring low attack complexity and no user interaction. Successful exploitation grants limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL queries.

Advisories and details are available via VulDB entries (ctiid.300662, id.300662, submit.519777), the vendor site phpgurukul.com, and a GitHub issue disclosing a public exploit that may be used. No specific patch information is detailed in the available references.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
art gallery management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated SQL injection in public-facing web app (/search.php) directly enables exploitation of the application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References