Is there a public PoC exploit available for CVE-2025-8156?

Yes, a public proof-of-concept exploit is available for CVE-2025-8156. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul User Registration & Login CVE-2025-8156

Q: What is the CVSS score of CVE-2025-8156?

CVE-2025-8156 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-25 cna@vuldb.com

PHP SQLi User Registration Login And User Management System

2.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:48 vuln.today

DescriptionNVD

A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/lastsevendays-reg-users.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated remote attackers to manipulate the ID parameter in /admin/lastsevendays-reg-users.php, leading to database query compromise with limited confidentiality and integrity impact. Public exploit code exists, though EPSS scoring (0.06%, 19th percentile) indicates exploitation remains unlikely in practice despite the low attack complexity and low privilege requirement.

Technical ContextAI

The vulnerability resides in improper input validation of the ID parameter passed to the /admin/lastsevendays-reg-users.php administrative endpoint. The application fails to properly sanitize or parameterize SQL queries, allowing attackers to inject arbitrary SQL syntax. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) indicates the root cause involves insufficient encoding or escaping of user-controlled input before inclusion in SQL statements. This is a classic SQL injection flaw typical of legacy PHP applications lacking prepared statement usage.

RemediationAI

Immediate action: upgrade PHPGurukul User Registration & Login and User Management System to a patched version beyond 3.3 if available from phpgurukul.com. If no newer version is available, implement input validation by using parameterized queries (prepared statements) in the /admin/lastsevendays-reg-users.php file to prevent SQL injection, replacing all direct string concatenation in SQL queries with bind parameters. Additionally, restrict administrative endpoint access via IP allowlisting or Web Application Firewall (WAF) rules blocking requests with SQL metacharacters (single quotes, semicolons, keywords like 'UNION', 'SELECT') in the ID parameter. Monitor database access logs for suspicious SQL patterns and verify that the application runs with minimal database privileges (read-only where possible for non-write operations). Review phpgurukul.com and VulDB references for patch availability confirmation.

CVE-2025-8156 vulnerability details – vuln.today

Back