What is the CVSS score of CVE-2025-5561?

CVE-2025-5561 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5561?

A critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System 1.0 allows remote attackers to manipulate database queries through the admin panel, potentially exposing or…

Is there a public PoC exploit available for CVE-2025-5561?

Yes, a public proof-of-concept exploit is available for CVE-2025-5561. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5561?

Within 24 hours: Immediately audit access logs to /admin/view-pass-detail.php for suspicious viewid parameter activity; isolate affected systems from untrusted networks if possible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the viewid parameter; implement input validation at the application layer if source code access exists. Within 30 days: Evaluate alternative e-Pass management solutions from vendors with active security support; plan and execute migration away from vulnerable system or implement comprehensive compensating controls if business-critical.

PHP CVE-2025-5561

EUVD-2025-16838 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Curfew E Pass Management System Phpgurukul

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16838

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 10, 2025 - 15:10 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 05:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/view-pass-detail.php. The manipulation of the argument viewid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Curfew e-Pass Management System version 1.0, specifically in the /admin/view-pass-detail.php file where the 'viewid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept code available, making it actively exploitable in the wild.

Technical ContextAI

This vulnerability stems from improper input validation in a PHP web application, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The root cause is the failure to implement parameterized queries or proper input sanitization on the 'viewid' parameter before it is incorporated into SQL statements. The affected product is PHPGurukul Curfew e-Pass Management System 1.0, a PHP-based web application designed for managing student curfew passes and access control. The vulnerability exists in an administrative interface endpoint that lacks proper authentication checks, allowing unauthenticated SQL injection attacks. The underlying issue reflects a common PHP vulnerability pattern where user-supplied input is directly concatenated into SQL queries without using prepared statements or ORM frameworks that would prevent such attacks.