CVE-2025-10664
📋 TL;DR
CVE-2025-10664 is a SQL injection vulnerability in PHPGurukul Small CRM 4.0 that allows remote attackers to execute arbitrary SQL commands via the 'subject' parameter in create-ticket.php. This affects all organizations using the vulnerable version of this CRM software, potentially exposing sensitive customer data and system information.
💻 Affected Systems
- PHPGurukul Small CRM
📦 What is this software?
Small Crm by Phpgurukul
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive CRM data including customer information, ticket details, and potentially user credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting the attacker to read-only access of non-sensitive data.
🎯 Exploit Status
The vulnerability is in a publicly accessible file with a simple parameter manipulation, making exploitation straightforward for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Test functionality after patching. 4. Currently no official patch is known.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'subject' parameter before processing
Modify create-ticket.php to include: $subject = mysqli_real_escape_string($conn, $_POST['subject']);
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL keywords in POST parameters
🧯 If You Can't Patch
- Restrict network access to the CRM application using firewall rules
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test the create-ticket.php endpoint with SQL injection payloads in the subject parameter and observe database errors or unexpected behavior.Check Version:
Check the CRM admin panel or application files for version information, typically in config files or footer.Verify Fix Applied:
Attempt the same SQL injection tests after applying fixes; successful input validation should reject malicious payloads without database errors.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server process
- SQL syntax errors in application logs
- Multiple failed ticket creation attempts with special characters
Network Indicators:
- HTTP POST requests to create-ticket.php containing SQL keywords (SELECT, UNION, etc.) in parameters
SIEM Query:
source="web_logs" AND uri="/create-ticket.php" AND (request_body CONTAINS "' OR" OR request_body CONTAINS "UNION SELECT" OR request_body CONTAINS "--")