EUVD-2025-19530Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires low-privilege authentication; SQL injection yields limited impact per initial CVSS.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in PHPGurukul Old Age Home Management System 1.0 allows remote authenticated attackers with low privileges to manipulate the sertitle parameter in /admin/edit-services.php, potentially leading to unauthorized database access or modification. Public exploit code is available, but there is no evidence of active exploitation in the wild. The vulnerability has a low CVSS 4.0 base score of 2.1, reflecting limited impact and authenticated access requirements.
Technical ContextAI
The vulnerability resides in the edit-services.php script of the PHPGurukul Old Age Home Management System web application, which is built with PHP. The affected endpoint handles service record updates and fails to properly sanitize the 'sertitle' parameter before incorporating it into a SQL query. This is a classic SQL injection (CWE-89 misclassification in the original data as CWE-74). The CPE data confirms the product is 'old_age_home_management_system:1.0' from vendor PHPGurukul.
RemediationAI
At the time of analysis, no vendor-released patch is available. As an immediate mitigation, restrict access to the /admin/edit-services.php endpoint to trusted administrators only, and enforce strong input validation on the sertitle parameter by implementing parameterized queries or stored procedures. Deploying a web application firewall (WAF) with SQL injection detection rules can provide temporary protection. Monitor authentication logs for unusual admin panel activity. If the system is not mission-critical, consider retiring the software in favor of a maintained alternative. The GitHub exploit reference (https://github.com/f1rstb100d/myCVE/issues/91) should be reviewed to understand the attack vector and refine signatures.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today