Which versions of PHP are affected by CVE-2025-7534?

PHPGurukul Student Result Management System 2.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise student data and system integrity.

Is there a public PoC exploit available for CVE-2025-7534?

Yes, a public proof-of-concept exploit is available for CVE-2025-7534. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7534?

Within 24 hours: Audit logs for exploitation attempts targeting /notice-details.php?nid parameter; disable public access to the application if feasible. Within 7 days: Implement WAF rules blocking SQL injection patterns in the nid parameter; conduct database access review for suspicious activity. Within 30 days: Migrate to an alternative student management system or coordinate with PHPGurukul for patch availability; if no patch emerges, decommission the vulnerable application.

PHP CVE-2025-7534

Q: What is the CVSS score of CVE-2025-7534?

CVE-2025-7534 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21261 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Student Result Management System Phpgurukul

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21261

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:55 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in PHPGurukul Student Result Management System 2.0. It has been classified as critical. Affected is an unknown function of the file /notice-details.php of the component GET Parameter Handler. The manipulation of the argument nid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable through the 'nid' GET parameter in /notice-details.php. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the application database. Public exploit disclosure and confirmed attack surface (unauthenticated, network-accessible endpoint) elevate real-world risk despite the moderate CVSS 7.3 score.

Technical ContextAI

The vulnerability resides in improper input validation and parameterization within the GET Parameter Handler of /notice-details.php. The underlying weakness is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), specifically manifesting as SQL injection (CWE-89 subclass). PHPGurukul Student Result Management System 2.0 fails to sanitize or use prepared statements for the 'nid' parameter before incorporating it into SQL queries. This is a common vulnerability in legacy PHP applications that concatenate user input directly into SQL strings rather than using parameterized queries or ORM frameworks. The affected component processes GET parameters without adequate input validation, allowing attackers to break out of intended SQL syntax and inject malicious SQL commands.

RemediationAI

Immediate actions: (1) Apply input validation to the 'nid' parameter—whitelist expected format (e.g., numeric ID only) and reject malformed input; (2) Refactor /notice-details.php to use parameterized queries (prepared statements) with placeholders instead of string concatenation; Example: Use mysqli_prepare() with ? placeholders or PDO with named parameters; (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in GET parameters (e.g., UNION, SELECT, OR 1=1 signatures) as interim mitigation; (4) Apply the principle of least privilege to database user credentials used by the application (read-only for SELECT queries if feasible). Long-term: Upgrade to a patched version when released by PHPGurukul (vendor patch details not provided in source data—contact vendor directly or monitor security advisories at phpgurukul.com or GitHub repository). No vendor advisory link provided in source intelligence.