PHP CVE-2025-5561

This vulnerability stems from improper input validation in a PHP web application, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The root cause is the failure to implement parameterized queries or proper input sanitization on the 'viewid' parameter before it is incorporated into SQL statements. The affected product is PHPGurukul Curfew e-Pass Management System 1.0, a PHP-based web application designed for managing student curfew passes and access control. The vulnerability exists in an administrative interface endpoint that lacks proper authentication checks, allowing unauthenticated SQL injection attacks. The underlying issue reflects a common PHP vulnerability pattern where user-supplied input is directly concatenated into SQL queries without using prepared statements or ORM frameworks that would prevent such attacks.