Which versions of PHP are affected by CVE-2025-5860?

A publicly disclosed SQL injection vulnerability in PHPGurukul Maid Hiring Management System 1.0 allows remote attackers to compromise database integrity and potentially extract sensitive booking and…

Is there a public PoC exploit available for CVE-2025-5860?

Yes, a public proof-of-concept exploit is available for CVE-2025-5860. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5860?

Within 24 hours: Isolate affected systems from production networks or restrict external access to the application; audit logs for exploitation attempts. Within 7 days: Deploy WAF rules to block malicious searchdata parameter payloads; conduct database access review and implement input validation patches at the application layer if possible. Within 30 days: Migrate to a patched version when released or replace the application with a vendor-supported alternative; perform forensic analysis and breach notification assessment if exploitation is confirmed.

PHP CVE-2025-5860

Q: What is the CVSS score of CVE-2025-5860?

CVE-2025-5860 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17424 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-09 cna@vuldb.com

PHP SQLi Maid Hiring Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17424

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jun 09, 2025 - 19:03 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in PHPGurukul Maid Hiring Management System 1.0. This affects an unknown part of the file /admin/search-booking-request.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection vulnerability in PHPGurukul Maid Hiring Management System 1.0 affecting the /admin/search-booking-request.php file, where unsanitized user input in the 'searchdata' parameter allows unauthenticated remote attackers to execute arbitrary SQL queries. With a CVSS score of 7.3 and publicly disclosed exploit code available, this vulnerability poses significant risk to confidentiality, integrity, and availability of affected systems. Active exploitation is likely given the public POC availability and network-accessible attack vector.

Technical ContextAI

This vulnerability exploits improper input validation in a PHP-based web application (PHPGurukul Maid Hiring Management System v1.0), specifically in the search functionality of the admin panel. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which encompasses SQL injection attacks. The searchdata parameter is directly incorporated into SQL queries without parameterized prepared statements or input sanitization. The application uses a PHP backend with likely MySQL/MariaDB database, and the vulnerability exists in an administrative endpoint that should theoretically require authentication, but the CVSS vector (PR:N - no privileges required) indicates the search functionality is accessible without authentication or with easily bypassed authentication checks.

RemediationAI

Immediate actions: (1) Disable or restrict network access to /admin/search-booking-request.php via firewall/WAF rules until patching is complete; (2) Check PHPGurukul's official repository (GitHub/website) for security patches - upgrade to the latest available version if available; (3) Apply WAF rules to block SQL injection patterns in the searchdata parameter (e.g., union, select, drop, exec, script injection patterns); (4) Implement input validation: whitelist allowed characters in searchdata, enforce maximum input length, and use parameterized prepared statements (PHP MySQLi with prepared statements or PDO with bound parameters) in search-booking-request.php. Code fix example: replace direct string concatenation with prepared statements: $stmt = $mysqli->prepare("SELECT * FROM bookings WHERE field = ?"); $stmt->bind_param("s", $_GET['searchdata']); (5) Conduct database audit for evidence of compromise (SQL logs, unauthorized data access); (6) Reset admin credentials if the system was exposed; (7) Monitor for active exploitation attempts in web server logs (requests containing SQL keywords in searchdata parameter). If vendor patch is unavailable, consider temporary migration to alternative booking systems or complete code review and hardening.