CVE-2025-2362
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System 1.0 allows attackers to manipulate database queries via the mobnum parameter in /admin/contact-us.php. Remote attackers can potentially access, modify, or delete sensitive data. All deployments of version 1.0 are affected.
💻 Affected Systems
- PHPGurukul Pre-School Enrollment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student, parent, and administrative data including personal information and enrollment records.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. The vulnerability requires no authentication and has straightforward exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If no patch exists, implement workarounds immediately. 3. Consider migrating to alternative software if vendor is unresponsive.
🔧 Temporary Workarounds
Input Validation and Sanitization
PHPImplement strict input validation and parameterized queries for all user inputs in contact-us.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM table WHERE mobnum = ?'); $stmt->bind_param('s', $mobnum);
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting mobnum parameter
Add WAF rule: Block requests with SQL keywords in mobnum parameter values
🧯 If You Can't Patch
- Block external access to /admin/contact-us.php via firewall rules or web server configuration
- Implement network segmentation to isolate the vulnerable system from sensitive data stores
🔍 How to Verify
Check if Vulnerable:
Test the /admin/contact-us.php endpoint with SQL injection payloads in the mobnum parameter and observe database errors or unexpected behavior.Check Version:
Check system documentation or admin panel for version information. The vulnerable version is specifically 1.0.Verify Fix Applied:
After implementing fixes, test with the same SQL injection payloads to confirm they are properly rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in mobnum parameter values
- Multiple failed database queries from single IP
- Database error messages in web logs
Network Indicators:
- HTTP POST requests to /admin/contact-us.php with SQL keywords in parameters
- Unusual traffic patterns to admin endpoints
SIEM Query:
source="web_logs" AND uri_path="/admin/contact-us.php" AND (param="mobnum" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--")