CVE-2025-10114: Phpgurukul Small CRM SQLi Vulnerability

CVE-2025-10114 Overview

CVE-2025-10114 is a SQL injection vulnerability in PHPGurukul Small CRM 4.0. The flaw resides in the /profile.php script, where the Name parameter is passed directly into a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database.

The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output). According to the VulDB advisory, exploit details have been made public, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact

Unauthenticated remote attackers can inject SQL through the Name argument in /profile.php, potentially exposing or modifying CRM data stored in the database.

Affected Products

• PHPGurukul Small CRM 4.0
• Component: /profile.php
• Vulnerable parameter: Name

Discovery Timeline

• 2025-09-09 - CVE-2025-10114 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10114

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the profile management functionality of PHPGurukul Small CRM 4.0. User-supplied input from the Name argument is concatenated into a SQL statement processed by /profile.php without parameterization or escaping.

Because the attack vector is network-based and requires no authentication or user interaction, an attacker only needs HTTP access to the application. The public availability of exploitation details, documented in the GitHub issue tracker, lowers the barrier for opportunistic attacks against internet-exposed CRM instances.

Successful exploitation can disclose CRM records, alter stored data, or escalate to further attacks such as authentication bypass through UNION-based queries or boolean-based blind extraction.

Root Cause

The root cause is the absence of prepared statements or input validation on the Name parameter handled by /profile.php. PHPGurukul Small CRM concatenates the raw value into a SQL query, allowing injection of malicious SQL syntax. The codebase does not enforce type checking, parameter binding, or output encoding for this input.

Attack Vector

An attacker issues a crafted HTTP request to /profile.php containing SQL metacharacters within the Name parameter. The injected payload is executed by the database engine, returning data or performing operations under the privileges of the CRM database user. No credentials are required, and the attack can be automated using tools such as sqlmap.

The vulnerability manifests in how /profile.php handles the Name argument. See the VulDB entry and the GitHub issue tracker for technical references.

Detection Methods for CVE-2025-10114

Indicators of Compromise

• HTTP requests to /profile.php containing SQL metacharacters in the Name parameter, such as single quotes, UNION SELECT, OR 1=1, or comment sequences like -- and /*.
• Unexpected database errors logged by the PHP application or backend MySQL/MariaDB instance referencing the profile.php endpoint.
• Outbound database queries returning large result sets or referencing tables outside the normal CRM workflow.

Detection Strategies

• Inspect web server access logs for anomalous query strings or POST bodies targeting /profile.php, particularly long or URL-encoded payloads on the Name field.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures to flag and block injection attempts against PHPGurukul endpoints.
• Enable database query logging and alert on syntactically invalid queries originating from the CRM application user.

Monitoring Recommendations

• Correlate web access logs with database error logs to identify probing activity targeting the Name parameter.
• Track HTTP response anomalies such as unusually large payloads or HTTP 500 responses from /profile.php.
• Monitor for sequential requests from a single source iterating common SQL injection payloads, which indicates automated exploitation tools.

How to Mitigate CVE-2025-10114

Immediate Actions Required

• Restrict access to PHPGurukul Small CRM 4.0 instances behind authentication, VPN, or IP allowlisting until a vendor fix is verified.
• Deploy WAF rules to block SQL injection patterns targeting the Name parameter on /profile.php.
• Audit the CRM database for unauthorized modifications, new accounts, or unexpected data exports.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD record for CVE-2025-10114. Monitor the PHPGurukul blog for updated releases addressing the SQL injection in /profile.php.

Workarounds

• Modify /profile.php to use parameterized queries via PDO or mysqli prepared statements rather than string concatenation.
• Apply input validation that restricts the Name field to expected character classes, rejecting SQL metacharacters.
• Enforce least-privilege on the CRM database account so that an injected query cannot read or modify unrelated tables.
• Consider migrating off PHPGurukul Small CRM 4.0 if no maintained patch is released for this issue.

# Example WAF rule (ModSecurity) to block SQLi attempts on the Name parameter
SecRule ARGS:Name "@detectSQLi" \
    "id:1010114,phase:2,deny,status:403,\
    msg:'Potential SQLi targeting CVE-2025-10114 in /profile.php',\
    logdata:'Matched Data: %{MATCHED_VAR} in %{REQUEST_URI}'"