Cyber Posture

CVE-2025-2648

HighPublic PoC

Published: 23 March 2025

Published
23 March 2025
Modified
27 March 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2648 is a critical SQL injection vulnerability (CWE-74, CWE-89) in PHPGurukul Art Gallery Management System 1.0. The flaw affects an unknown part of the file /admin/view-enquiry-detail.php, where manipulation of the 'viewid' argument enables SQL injection.

An unauthenticated remote attacker can exploit this vulnerability remotely with low attack complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation can result in limited impacts to confidentiality, integrity, and availability.

VulDB advisories (ctiid.300663, id.300663, submit.519779) detail the issue, while a GitHub repository (liuhao2638/cve/issues/11) discloses a public exploit. The vendor site phpgurukul.com is referenced, but no patches or specific mitigations are outlined in the available information.

Details

CWE(s)
CWE-74CWE-89

Affected Products

phpgurukul
art gallery management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability in public-facing web application (/admin/view-enquiry-detail.php) enables exploitation of public-facing application (T1190) and unauthorized data collection from databases (T1213.006).

References