CVE-2025-6319
📋 TL;DR
A critical SQL injection vulnerability exists in PHPGurukul Pre-School Enrollment System 1.0, specifically in the /admin/add-teacher.php file's tsubject parameter. This allows remote attackers to execute arbitrary SQL commands on the database. Organizations using this software are affected.
💻 Affected Systems
- PHPGurukul Pre-School Enrollment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student, teacher, and administrative data, including personal information and system credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to the affected table.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub, making it easy for attackers to weaponize. Exploitation likely requires admin authentication to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch is available. Check the vendor website for updates or consider alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the tsubject parameter in add-teacher.php.
Modify PHP code to use prepared statements: $stmt = $conn->prepare('INSERT INTO teachers (tsubject) VALUES (?)'); $stmt->bind_param('s', $tsubject); $stmt->execute();
Web Application Firewall (WAF)
allDeploy a WAF to block SQL injection attempts targeting the /admin/add-teacher.php endpoint.
Configure WAF rules to detect and block SQL patterns in POST parameters, e.g., using ModSecurity with OWASP CRS.
🧯 If You Can't Patch
- Disable or restrict access to the /admin/add-teacher.php endpoint using network ACLs or authentication hardening.
- Implement database-level controls such as least privilege accounts and regular auditing of SQL logs.
🔍 How to Verify
Check if Vulnerable:
Test the /admin/add-teacher.php endpoint with SQL injection payloads in the tsubject parameter (e.g., ' OR '1'='1) and observe database errors or unexpected behavior.Check Version:
Check the software version in the admin panel or via file metadata; no standard command exists as it's a custom web application.Verify Fix Applied:
After applying workarounds, retest with SQL injection payloads to ensure no database errors or unauthorized data access occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs from the web server IP, especially involving the teachers table or tsubject parameter.
- HTTP POST requests to /admin/add-teacher.php with suspicious characters like quotes, semicolons, or SQL keywords in parameters.
Network Indicators:
- HTTP traffic to /admin/add-teacher.php containing SQL injection patterns in POST data.
SIEM Query:
source="web_logs" AND url="/admin/add-teacher.php" AND (post_data LIKE "%' OR '%" OR post_data LIKE "% UNION %" OR post_data LIKE "%SELECT %")