CVE-2025-2677
Published: 24 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-2677 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in PHPGurukul Bank Locker Management System version 1.0. The issue resides in unknown code within the file /changeidproof.php, where manipulation of the 'editid' argument triggers the injection.
The vulnerability is remotely exploitable by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no requirement for user interaction (UI:N), carrying a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation enables limited impacts on confidentiality, integrity, and availability.
Advisories detail the issue across references including https://github.com/ARPANET-cyber/CVE/issues/6, https://phpgurukul.com/, and VulDB entries at https://vuldb.com/?ctiid.300694, https://vuldb.com/?id.300694, and https://vuldb.com/?submit.521444. The exploit has been publicly disclosed and may be in use.
The vulnerability was published on 2025-03-24.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in a remotely accessible web application (PHPGurukul Bank Locker Management System) directly enables initial access by unauthenticated attackers via exploitation of a public-facing app.