CVE-2025-5860

Immediate actions: (1) Disable or restrict network access to /admin/search-booking-request.php via firewall/WAF rules until patching is complete; (2) Check PHPGurukul's official repository (GitHub/website) for security patches - upgrade to the latest available version if available; (3) Apply WAF rules to block SQL injection patterns in the searchdata parameter (e.g., union, select, drop, exec, script injection patterns); (4) Implement input validation: whitelist allowed characters in searchdata, enforce maximum input length, and use parameterized prepared statements (PHP MySQLi with prepared statements or PDO with bound parameters) in search-booking-request.php. Code fix example: replace direct string concatenation with prepared statements: $stmt = $mysqli->prepare("SELECT * FROM bookings WHERE field = ?"); $stmt->bind_param("s", $_GET['searchdata']); (5) Conduct database audit for evidence of compromise (SQL logs, unauthorized data access); (6) Reset admin credentials if the system was exposed; (7) Monitor for active exploitation attempts in web server logs (requests containing SQL keywords in searchdata parameter). If vendor patch is unavailable, consider temporary migration to alternative booking systems or complete code review and hardening.