PHPGurukul Beauty Parlour Management System CVE-2025-11330

Exploitation requires valid administrative authentication - the CVSS PR:L vector confirms unauthenticated remote users cannot access the vulnerable endpoint. An attacker must either possess legitimate admin credentials or compromise an admin account through separate attack (phishing, credential reuse, etc.). The fromdate and todate parameters must be submitted via HTTP request to /admin/sales-reports-detail.php; default configurations of the application do not prevent access to this file by authenticated admins. No non-default configuration or special feature enablement is mentioned in the CVE description, indicating the vulnerability exists in standard deployments. Limitations: the attack is restricted to authenticated admins only, SQL injection impact is bounded to data disclosure (VC:L/VI:L/VA:L per CVSS) with no apparent ability to achieve code execution or data destruction, and the admin user role itself implies trusted access scope.

Despite public exploit availability, real-world risk is minimal based on multiple risk signals. The CVSS 2.1 score (CSSv4.0 vector AV:N/AC:L/PR:L) reflects network accessibility but mandates prior authentication with admin privileges (PR:L), significantly limiting the attacker pool. EPSS percentile of 11% (0.04% exploitation probability) indicates this ranks in the lowest exploitation likelihood quartile, suggesting limited automated attack tooling or widespread targeting. The CVSS impact ratings (VC:L/VI:L/VA:L) confirm restricted damage scope - confidentiality, integrity, and availability impacts are all low. The contradiction between public POC availability (E:P) and very low EPSS suggests exploitation requires non-trivial prerequisites (valid admin account access) that defenders can control through access restrictions. This is a low-priority patch candidate for most organizations unless admin account compromise is a documented threat model.

An authenticated administrator (or attacker who has compromised valid admin credentials through phishing or credential stuffing) navigates to or crafts an HTTP request to /admin/sales-reports-detail.php and injects SQL payload into the fromdate parameter, such as fromdate=' UNION SELECT user_email, user_password FROM users WHERE '1'='1. The vulnerable PHP code concatenates this unsanitized input directly into an SQL query, causing the injected UNION clause to execute alongside the intended query. The attacker extracts sensitive data (user credentials, financial records) from the database response without triggering alerts, since the request appears as a legitimate admin feature access.