Which versions of PHP are affected by CVE-2025-5707?

A critical SQL injection vulnerability in PHPGurukul Human Metapneumovirus Testing Management System allows remote attackers to compromise the database without authentication.

Is there a public PoC exploit available for CVE-2025-5707?

Yes, a public proof-of-concept exploit is available for CVE-2025-5707. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5707?

Within 24 hours: Isolate affected systems from production networks if possible and disable the /registered-user-testing.php endpoint. Within 7 days: Implement WAF rules to block SQL injection patterns on testtype parameter, conduct database audit for unauthorized access, and identify all instances of this application across the environment. Within 30 days: Evaluate migration to alternative solutions or hardened fork versions, review all database access logs for breach indicators, and establish timeline for application retirement or replacement.

PHP CVE-2025-5707

Q: What is the CVSS score of CVE-2025-5707?

CVE-2025-5707 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17040 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-06 cna@vuldb.com

PHP SQLi Human Metapneumovirus Hmpv Testing Management System Anujk305

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17040

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Jun 10, 2025 - 15:00 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 01:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registered-user-testing.php. The manipulation of the argument testtype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Human Metapneumovirus Testing Management System 1.0, affecting the /registered-user-testing.php file via the 'testtype' parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database records without user interaction. The exploit has been publicly disclosed and is likely actively exploited in the wild, making this a high-priority security issue despite the moderate CVSS 7.3 score.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The /registered-user-testing.php endpoint directly incorporates user-supplied input from the 'testtype' parameter into SQL queries without parameterized statements or prepared statement usage. This classic SQL injection flaw allows attackers to manipulate SQL syntax, breaking out of intended query contexts to execute arbitrary database commands. The application processes user input through PHP with database operations likely performed via MySQLi or PDO without proper escaping or query parameterization.

RemediationAI

Immediate actions: (1) Apply input validation: implement strict whitelist validation for the 'testtype' parameter accepting only known valid test type values; (2) Use parameterized queries: refactor /registered-user-testing.php to use prepared statements with bound parameters in all database interactions; (3) Apply SQL escaping: at minimum, use mysqli_real_escape_string() or equivalent, though parameterized queries are strongly preferred; (4) Web Application Firewall (WAF) rules: deploy WAF signatures to block SQL injection patterns in testtype parameter; (5) Check for vendor patches via phpgurukul.com or GitHub repository; (6) If no patch available, implement query string filtering at application middleware level. For organizations unable to patch immediately: disable or restrict access to /registered-user-testing.php via network controls (IP whitelisting, VPN requirement) until patched.