Which versions of PHP are affected by CVE-2025-6330?

PHPGurukul Directory Management System 1.0 contains a critical SQL injection vulnerability in the search functionality that allows unauthenticated remote attackers to compromise database integrity…

Is there a public PoC exploit available for CVE-2025-6330?

Yes, a public proof-of-concept exploit is available for CVE-2025-6330. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6330?

Within 24 hours: Identify all instances of PHPGurukul DMS 1.0 in production and take inventory of exposed systems; implement WAF rules to block malicious searchdata parameter patterns; disable the /searchdata.php endpoint if operationally feasible. Within 7 days: Apply input validation and parameterized queries to the affected code; conduct database access audit for signs of compromise; notify stakeholders if systems were exposed. Within 30 days: Plan migration to a patched version or alternative solution; complete security code review of all user input handling; implement comprehensive monitoring for SQL injection attempts.

PHP CVE-2025-6330

Q: What is the CVSS score of CVE-2025-6330?

CVE-2025-6330 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18744 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Directory Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18744

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 18:48 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 10:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in PHPGurukul Directory Management System 1.0. Affected is an unknown function of the file /searchdata.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6330 is a critical SQL injection vulnerability in PHPGurukul Directory Management System version 1.0, specifically in the /searchdata.php file's 'searchdata' parameter. An unauthenticated remote attacker can inject arbitrary SQL commands to compromise confidentiality, integrity, and availability of the underlying database. Public disclosure and proof-of-concept exploitation have occurred, making this an immediately actionable threat despite the moderate CVSS 7.3 score.

Technical ContextAI

The vulnerability exists in PHPGurukul Directory Management System 1.0, a PHP-based directory management application. The /searchdata.php endpoint accepts user-supplied input via the 'searchdata' parameter without proper input validation or prepared statements, allowing attackers to inject SQL metacharacters. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection when output is improperly sanitized before database queries. The root cause is the absence of parameterized queries or input filtering mechanisms that would neutralize SQL syntax characters. The affected technology stack includes PHP runtime environment and a backend SQL database (likely MySQL/MariaDB or PostgreSQL).

RemediationAI

Immediate actions: (1) Identify and inventory all deployments of PHPGurukul Directory Management System 1.0 in your environment; (2) If vendor patches exist, upgrade to the latest patched version immediately; (3) If no official patch is available (likely given project age), implement input validation and output encoding: replace all direct SQL queries in /searchdata.php with prepared statements/parameterized queries using PHP PDO or mysqli prepared statements; (4) Short-term mitigation: implement Web Application Firewall (WAF) rules to block SQL injection patterns in the searchdata parameter (regex patterns for common SQL keywords and metacharacters); (5) Database-level mitigation: apply principle of least privilege to database user accounts used by the application; (6) Monitor database query logs for suspicious activity; (7) Consider decommissioning or replacing PHPGurukul 1.0 with actively maintained directory management solutions if vendor support is unavailable.