What is the CVSS score of CVE-2025-5576?

CVE-2025-5576 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5576?

A publicly disclosed SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote attackers to manipulate database queries through the date filter parameters,…

Is there a public PoC exploit available for CVE-2025-5576?

Yes, a public proof-of-concept exploit is available for CVE-2025-5576. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5576?

Within 24 hours: Identify all systems running Dairy Farm Shop Management System 1.3 and isolate them or restrict network access to trusted networks only; document current configurations. Within 7 days: Implement WAF rules blocking SQL injection patterns in /bwdate-report-details.php parameters (fromdate/todate); disable the date-report feature if operationally feasible; apply input validation and parameterized queries if source code modifications are possible. Within 30 days: Evaluate alternative farm management solutions; develop migration plan to replace the vulnerable system; conduct forensic audit to detect prior exploitation.

PHP CVE-2025-5576

EUVD-2025-16858 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Dairy Farm Shop Management System Phpgurukul

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16858

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 04, 2025 - 18:28 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects some unknown processing of the file /bwdate-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /bwdate-report-details.php file where the fromdate and todate parameters are inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk.

Technical ContextAI

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), a classic input validation failure in PHP-based web applications. The affected component is the Dairy Farm Shop Management System, a PHP application built on traditional LAMP stack architecture. The vulnerability exists in the date-filtering functionality of the bwdate-report-details.php endpoint, which constructs SQL queries by directly concatenating user-supplied input (fromdate/todate parameters) without proper parameterized queries or prepared statements. This allows attackers to break out of intended SQL context and inject arbitrary SQL syntax. The root cause is improper input sanitization before SQL query construction, a common issue in legacy PHP applications that predate widespread adoption of prepared statements and ORM frameworks.

RemediationAI

Immediate remediation steps: (1) Apply vendor security patch immediately if available from PHPGurukul official sources; (2) If no patch exists, implement emergency input validation by replacing direct SQL concatenation with prepared statements/parameterized queries for all date parameters; (3) Implement input whitelist validation restricting fromdate/todate to expected date format (e.g., YYYY-MM-DD via regex); (4) Apply principle of least privilege to database user account executing these queries, limiting to SELECT-only permissions if possible; (5) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in date parameters (e.g., strings containing quotes, SQL keywords, semicolons); (6) Disable or restrict access to /bwdate-report-details.php via authentication controls or IP whitelisting until patched; (7) Review query logs for evidence of exploitation attempts. Long-term: Upgrade to a maintained version of the application or consider migration to actively supported Dairy Farm management solutions. Recommend checking PHPGurukul's official website or GitHub repository for patch availability.