PHPGurukul User Registration & Login CVE-2025-8156

Exploitation requires authenticated access with administrative role or sufficient privilege level to reach the /admin/lastsevendays-reg-users.php endpoint (PR:L in CVSS confirms low privilege escalation is sufficient, but some admin-level access is still mandatory). The ID parameter must be passed as a URL or POST parameter to the vulnerable endpoint; default or typical application configurations do not disable this functionality. No special configuration is required - the vulnerability exists in standard installations. Limiting factors: (1) attacker must possess valid PHPGurukul admin credentials or compromise an admin session, (2) the endpoint is typically inaccessible to unauthenticated users, (3) database error messages may be suppressed in production configurations, limiting blind SQL injection effectiveness.

This vulnerability exhibits a significant disconnect between CVSS metrics and real-world exploitation likelihood. CVSS:4.0 assigns a low base score (2.1) despite AV:N (network), AC:L (low complexity), and PR:L (low privilege requirement) - the score is suppressed by limited impact ratings (VC:L, VI:L, VA:L, all confined to confidentiality/integrity with no availability impact). EPSS 0.06% (19th percentile) strongly confirms low exploitation probability. However, the presence of publicly disclosed exploit code (E:P) elevates the threat for organizations still running version 3.3. The critical real-world risk factors: (1) requires authenticated access (PR:L), reducing automated mass exploitation, (2) no availability impact limits damage scope, (3) database damage is limited to data leakage or modification, not destruction. For organizations with unpatched legacy instances and weak administrative access controls, this poses moderate risk; for those with strong access isolation and patched systems, risk is minimal. The discrepancy between 'critical' classification in the description and CVSS 2.1 appears to reflect vendor over-classification rather than actual severity.

An authenticated administrator account (or lower-privileged admin user if access controls are weak) sends a crafted HTTP request to /admin/lastsevendays-reg-users.php?ID=1' UNION SELECT user(),database(),version()-- with SQL injection payload in the ID parameter. The unsanitized query executes, returning sensitive database metadata (database name, version, user privileges) or user credentials. An attacker with legitimate but limited admin credentials can escalate data leakage by extracting additional tables or modifying records through UNION-based or time-based SQL injection.