EUVD-2025-21270Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to the web application
-
ExploitAccess /admin/manage-users.php with a malicious ID parameter
-
ExecutionInject SQL payload into the database query
-
ImpactExfiltrate or modify sensitive database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | The attacker must be authenticated with at least low-level privileges on the PHPGurukul User Management System. The /admin/manage-users.php endpoint must be reachable (typically authenticated users have access). No other special configuration or feature enabling is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) suggests low impact per metric, but typical SQL injection can fully compromise database confidentiality and integrity, so the actual impact is likely higher. The EPSS score is 0.04%, indicating very low probability of widespread exploitation. There is no KEV listing, and while a public proof-of-concept exists, no active exploitation has been reported. If the admin interface allows any authenticated user, the risk is elevated for environments that expose it; however, if access is restricted to privileged accounts, the real-world risk is reduced. Overall, this appears to be a moderate risk vulnerability-exploitable but unlikely to be broadly targeted. |
| Exploit ScenarioDerived | An authenticated low-privileged attacker sends a crafted HTTP request to /admin/manage-users.php with a malicious SQL payload in the ID parameter. The backend constructs and executes the SQL query without proper sanitization, allowing the attacker to extract user credentials or modify database records. A public proof-of-concept exploit is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated, low-privilege attackers to manipulate SQL queries via the ID parameter of /admin/manage-users.php. Public exploit code is available, but there is no evidence of active exploitation (not in CISA KEV). Exploitation can lead to unauthorized access, modification, or extraction of database contents, including user credentials.
RemediationAI
No official patch has been released by the vendor. As a temporary workaround, restrict access to /admin/manage-users.php to trusted users only, deploy a Web Application Firewall (WAF) rule to detect and block SQL injection patterns targeting the ID parameter, and if source code is available, apply input sanitization using prepared statements or parameterized queries. Note that WAF rules may be bypassed by obfuscated payloads, and access restriction alone does not prevent abuse by legitimate authenticated users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in a PHP-based user management framework where the /admin/manage-users.php endpoint fails to properly sanitize the ID input before including it in an SQL statement, leading to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected product is identified by CPE cpe:2.3:a:phpgurukul:user_registration_\&_login_and_user_management_system:3.3:*:*:*:*:*:*:*. The underlying technology stack likely uses MySQL or similar relational database, and the injection occurs through an administrative interface that should only be accessible after authentication.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated low‑privilege access to the vulnerable admin endpoint is required, but successful SQL injection can fully compromise database confidentiality and integrity.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in PHPGurukul User Registration & Login and User Management System 3.3. It has been classified as critical. This affects an unknown part of the file /admin/manage-users.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB