What is the CVSS score of EUVD-2025-16856?

EUVD-2025-16856 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-16856?

A remote SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System v1.3 allows attackers to potentially extract or manipulate database records without authentication.

Is there a public PoC exploit available for EUVD-2025-16856?

Yes, a public proof-of-concept exploit is available for EUVD-2025-16856. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-16856?

Within 24 hours: Inventory all systems running PHPGurukul Dairy Farm Shop Management System 1.3 and isolate affected instances from production networks if operationally feasible. Within 7 days: Implement WAF rules to block SQL injection patterns in the /sales-report-details.php fromdate/todate parameters, and restrict access to this endpoint to authorized internal networks only. Within 30 days: Evaluate upgrading to a patched version when available, or migrate to an alternative vendor solution if the vendor does not release a patch within a reasonable timeframe.

PHP EUVD-2025-16856

| CVE-2025-5578 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Dairy Farm Shop Management System Phpgurukul

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16856

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 04, 2025 - 18:27 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sales-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /sales-report-details.php file affecting the fromdate and todate parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working proof-of-concept code available, making active exploitation likely in the wild.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in a PHP-based web application. The /sales-report-details.php endpoint fails to properly sanitize or parameterize user input from the 'fromdate' and 'todate' HTTP parameters before incorporating them into SQL queries. The affected product is PHPGurukul Dairy Farm Shop Management System (CPE approximation: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3:*:*:*:*:*:*:*). The root cause is insufficient input validation and lack of prepared statements or parameterized queries, allowing attackers to break out of intended SQL query context and inject malicious SQL syntax.

RemediationAI

patch: Check PHPGurukul official website or GitHub repository for version 1.4+ which may contain fixes; contact vendor directly for security updates workaround: Implement strict input validation on date parameters using whitelist patterns (YYYY-MM-DD format only); reject any input containing SQL metacharacters or unexpected syntax workaround: Use prepared statements/parameterized queries in /sales-report-details.php; refactor all date parameter handling to use bound parameters instead of string concatenation mitigation: Deploy Web Application Firewall (WAF) rules to block SQL injection payloads targeting date parameters; monitor for suspicious query patterns in application logs mitigation: Restrict database user privileges to read-only where possible; implement principle of least privilege for database connections used by this application mitigation: Consider disabling or restricting access to /sales-report-details.php until patching is available; limit access by IP address or require VPN authentication