Which versions of PHP are affected by CVE-2025-6155?

A critical SQL injection vulnerability in PHPGurukul Hostel Management System 1.0 allows attackers to remotely compromise user authentication and access sensitive hostel data without a vendor patch…

Is there a public PoC exploit available for CVE-2025-6155?

Yes, a public proof-of-concept exploit is available for CVE-2025-6155. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6155?

Within 24 hours: Immediately isolate or take offline any PHPGurukul Hostel Management System 1.0 instances from production; if disconnection is not feasible, restrict network access to trusted IPs only and implement WAF rules blocking SQL injection patterns in the login parameter. Within 7 days: Conduct a forensic audit of login logs and database access for signs of exploitation; notify all system users of the vulnerability and mandate password resets; identify alternative hostel management solutions or contact the vendor for patched version availability. Within 30 days: Deploy replacement system or implement a compensating control solution; complete full security assessment of any remaining legacy systems; establish vendor patch monitoring process.

PHP CVE-2025-6155

Q: What is the CVSS score of CVE-2025-6155?

CVE-2025-6155 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18443 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-17 cna@vuldb.com

PHP SQLi Hostel Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18443

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

PoC Detected

Jun 24, 2025 - 15:53 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 03:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /includes/login-hm.inc.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Hostel Management System 1.0 affecting the login functionality (/includes/login-hm.inc.php). An unauthenticated attacker can manipulate the Username parameter to execute arbitrary SQL queries remotely, potentially compromising data confidentiality, integrity, and availability. Public exploit disclosure and active exploitation potential significantly elevate real-world risk despite a moderate CVSS score of 7.3.

Technical ContextAI

The vulnerability exists in PHPGurukul Hostel Management System 1.0, a PHP-based web application for hostel administration. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output), specifically manifesting as SQL injection in the login module. The /includes/login-hm.inc.php file fails to properly sanitize or parameterize the Username input parameter before incorporating it into SQL queries. This allows attackers to inject malicious SQL syntax (e.g., ' OR '1'='1) to bypass authentication, extract sensitive data, or modify database contents. The vulnerability affects the authentication layer, a critical trust boundary in any web application.

RemediationAI

Immediate actions: (1) Apply input validation to the Username parameter—use allowlist-based validation (alphanumeric + specific symbols only) and enforce length limits; (2) Implement parameterized queries or prepared statements in /includes/login-hm.inc.php to separate SQL logic from data; (3) Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns (e.g., quotes, UNION, SELECT keywords in login parameters); (4) Consider upgrading to a newer version of PHPGurukul if available, or migrate to maintained hostel management solutions; (5) Conduct a security audit of all authentication-related code in the application. No official vendor patch is currently available; coordinate with PHPGurukul maintainers for a security update. Short-term workaround: disable the application or restrict access via network controls until patched.