CVE-2025-6320
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System 1.0 allows attackers to manipulate database queries through the classname parameter in /admin/add-class.php. Attackers can execute arbitrary SQL commands remotely, potentially compromising the entire database. Organizations using this specific version of the enrollment system are affected.
💻 Affected Systems
- PHPGurukul Pre-School Enrollment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation to admin, and potential server takeover via SQL injection to RCE chain
Likely Case
Database information disclosure, unauthorized data modification, and potential authentication bypass
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation
🎯 Exploit Status
Exploit details publicly disclosed on GitHub. SQL injection via classname parameter is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize classname parameter before processing
Edit /admin/add-class.php to add input validation: $classname = mysqli_real_escape_string($conn, $_POST['classname']);
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the system in a separate network segment with strict access controls
- Implement database user with minimal privileges and enable query logging
🔍 How to Verify
Check if Vulnerable:
Test /admin/add-class.php endpoint with SQL injection payloads in classname parameterCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Attempt SQL injection after implementing fixes; should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts after SQL injection
- Requests to /admin/add-class.php with SQL keywords
Network Indicators:
- HTTP POST requests to /admin/add-class.php containing SQL injection patterns
- Unusual database traffic from web server
SIEM Query:
source="web_logs" AND uri="/admin/add-class.php" AND (payload CONTAINS "UNION" OR payload CONTAINS "SELECT" OR payload CONTAINS "OR 1=1")