EUVD-2025-18772Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /visit.php. The manipulation of the argument gname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-6322 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /visit.php file's 'gname' parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and confirmed POC availability significantly elevate real-world exploitation risk.
Technical ContextAI
The vulnerability resides in the /visit.php file of PHPGurukul Pre-School Enrollment System, a PHP-based web application for educational institution management. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection. The 'gname' parameter is passed to the application without proper input validation or parameterized query preparation, allowing attackers to inject malicious SQL syntax directly into database queries. This represents a classic instance of unsanitized user input being concatenated into dynamic SQL statements rather than using prepared statements with bound parameters.
RemediationAI
Immediate remediation steps: (1) DISABLE or RESTRICT access to /visit.php via web server configuration (Apache .htaccess or Nginx rules) until patching is available; (2) IMPLEMENT input validation on the 'gname' parameter using whitelist approaches (alphanumeric characters only if applicable); (3) REFACTOR the vulnerable code to use prepared statements with parameterized queries instead of string concatenation; (4) APPLY Web Application Firewall (WAF) rules to block common SQL injection patterns in the 'gname' parameter (keywords: UNION, SELECT, OR 1=1, etc.); (5) UPGRADE to PHPGurukul version 1.1 or later if available from vendor; (6) If no patch exists, consider migrating to an actively maintained enrollment system with security patching support; (7) AUDIT database logs for evidence of prior exploitation attempts.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today