CVE-2025-6915
📋 TL;DR
A critical SQL injection vulnerability exists in PHPGurukul Student Record System 3.2's /register.php file, allowing remote attackers to manipulate database queries through the session parameter. This affects all deployments of version 3.2 that expose the vulnerable endpoint. Attackers can potentially access, modify, or delete sensitive student and system data.
💻 Affected Systems
- PHPGurukul Student Record System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive student records, personal information, and system credentials stored in the database
If Mitigated
Limited data exposure if proper input validation and WAF rules are in place
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to /register.php
Edit /register.php to replace raw SQL with prepared statements using PDO or mysqli
Web Application Firewall Rules
allBlock SQL injection patterns targeting /register.php
Add WAF rule: deny requests to /register.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Restrict access to /register.php using IP whitelisting or authentication
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /register.php with SQL injection payloads in session parameter or check if running version 3.2Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /register.php with special characters
Network Indicators:
- HTTP requests to /register.php containing SQL keywords (UNION, SELECT, etc.)
SIEM Query:
source="web_logs" AND uri="/register.php" AND (payload="' OR " OR payload="UNION" OR payload="SELECT")