EUVD-2025-20391Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack with low complexity, low privileges required; SQL injection yields limited data exposure and modification.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/add-animals.php. The manipulation of the argument cnum leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate the 'cnum' parameter in /admin/add-animals.php, leading to unauthorized database access or data modification. Public exploit code exists but no active exploitation has been confirmed; EPSS score is low at 0.06%.
Technical ContextAI
The vulnerability lies in a PHP-based web application handling animal records, where user-supplied input to the 'cnum' parameter is not properly sanitized before being used in a SQL query. The root cause class is Injection (CWE-74), typical of SQL injection flaws in dynamic database interactions. The affected product is PHPGurukul Zoo Management System version 2.1, as identified by CPE cpe:2.3:a:phpgurukul:zoo_management_system:2.1.
RemediationAI
No vendor-released patch is identified at the time of analysis. As an immediate workaround, restrict network access to the /admin/ directory (e.g., via IP whitelisting or firewall rules) to minimize exposure. Alternatively, disable the add-animals.php functionality if not essential, but this may impair application usability. Apply input validation or parameterized queries to the 'cnum' parameter in the application code to eliminate the SQL injection risk. Monitor vendor communication at https://phpgurukul.com/ for an official fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today