What is the CVSS score of CVE-2025-5663?

CVE-2025-5663 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5663?

A remote SQL injection vulnerability in PHPGurukul Auto Taxi Stand Management System 1.0 allows unauthenticated attackers to compromise database integrity and extract sensitive data.

Is there a public PoC exploit available for CVE-2025-5663?

Yes, a public proof-of-concept exploit is available for CVE-2025-5663. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5663?

Within 24 hours: Isolate affected systems from internet-facing access and identify all instances in your environment. Within 7 days: Implement WAF rules to block malicious searchdata parameter patterns, apply input validation at the application layer, and evaluate migration to alternative vendor solutions. Within 30 days: Complete decommissioning of the affected application or upgrade to a patched version if the vendor releases one.

PHP CVE-2025-5663

EUVD-2025-16995 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-05 cna@vuldb.com

PHP SQLi Auto Taxi Stand Management System Phpgurukul

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16995

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 06, 2025 - 18:43 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Auto Taxi Stand Management System version 1.0, specifically in the /admin/search-autoortaxi.php file's 'searchdata' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept code available, creating immediate risk of active exploitation.

Technical ContextAI

The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, a variant of improper input validation leading to SQL injection). The affected application is PHPGurukul Auto Taxi Stand Management System 1.0, a PHP-based web application for managing taxi stand operations. The vulnerable code path exists in the administrative search functionality (/admin/search-autoortaxi.php), where user-supplied input via the 'searchdata' parameter is passed directly into SQL queries without proper sanitization or parameterized query preparation. This classic SQL injection flaw allows attackers to inject malicious SQL syntax to manipulate query logic.

RemediationAI

Immediate actions: (1) Patch to a patched version if PHPGurukul releases one—monitor vendor's official website/GitHub repository for updates (no specific patch version identified in available intelligence); (2) If patching is delayed, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'searchdata' parameter (detect common SQL keywords: UNION, SELECT, OR, DROP, etc.); (3) Apply input validation: whitelist allowed characters for search queries, reject inputs containing SQL metacharacters; (4) Use parameterized prepared statements in the search-autoortaxi.php code; (5) Implement rate-limiting and authentication enforcement on the /admin/ path to restrict access; (6) Conduct a database audit to detect unauthorized access or data exfiltration post-disclosure. Until patched, restrict administrative console access via IP whitelisting or VPN.