CVE-2025-10663
📋 TL;DR
This SQL injection vulnerability in PHPGurukul Online Course Registration 3.1 allows attackers to manipulate database queries through the 'cgpa' parameter in my-profile.php. Remote attackers can potentially access, modify, or delete sensitive data in the database. All users running the vulnerable version are affected.
💻 Affected Systems
- PHPGurukul Online Course Registration
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student/course data, potential credential theft, and database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation for the cgpa parameter in my-profile.php
Modify my-profile.php to use prepared statements: $stmt = $conn->prepare('UPDATE users SET cgpa = ? WHERE id = ?'); $stmt->bind_param('si', $cgpa, $id);
Web Application Firewall (WAF) Rules
allBlock SQL injection patterns targeting the cgpa parameter
Add WAF rule: SecRule ARGS:cgpa "@detectSQLi" "id:1001,deny,status:403"
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Deploy a web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if /my-profile.php exists and accepts cgpa parameter without proper sanitizationCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test SQL injection attempts against the cgpa parameter should be blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests with SQL injection payloads in cgpa parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (uri="/my-profile.php" AND (query="*cgpa=*UNION*" OR query="*cgpa=*SELECT*" OR query="*cgpa=*OR*"))