EUVD-2025-18773CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /enrollment.php. The manipulation of the argument fathername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Analysis
CVE-2025-6323 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, specifically affecting the /enrollment.php file's 'fathername' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the enrollment database. The vulnerability has public proof-of-concept code available and may be actively exploited in the wild.
Technical Context
This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which is the parent class for SQL injection flaws. The affected application is a PHP-based enrollment management system (CPE: cpe:2.3:a:phpgurukul:pre-school_enrollment_system:1.0) that fails to sanitize or parameterize user-supplied input in the 'fathername' parameter before incorporating it into SQL queries. The vulnerability is present in /enrollment.php, indicating insufficient input validation at the application tier. The attack exploits the lack of prepared statements or parameterized queries, allowing attackers to inject malicious SQL syntax through the HTTP request.
Affected Products
Pre-School Enrollment System (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today