CVE-2025-4154: Pre-school Enrollment System SQLi Flaw

CVE-2025-4154 Overview

CVE-2025-4154 is a SQL injection vulnerability in PHPGurukul Pre-School Enrollment System 1.0. The flaw exists in the /admin/enrollment-details.php file, where the Status parameter is not properly sanitized before being used in a database query. An authenticated attacker with low privileges can manipulate the Status argument to inject arbitrary SQL statements remotely. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against unpatched installations. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low-privileged admin panel access can extract, modify, or delete records in the application database through SQL injection on the Status parameter.

Affected Products

PHPGurukul Pre-School Enrollment System 1.0
Component: /admin/enrollment-details.php
Vendor: PHPGurukul

Discovery Timeline

2025-05-01 - CVE-2025-4154 published to NVD
2025-05-07 - Last updated in NVD database

Technical Details for CVE-2025-4154

Vulnerability Analysis

The vulnerability resides in the administrative interface of the PHPGurukul Pre-School Enrollment System. The /admin/enrollment-details.php script accepts a Status parameter that is concatenated directly into a SQL query without parameterization or input validation. An attacker submitting crafted input to this parameter can break out of the intended query context and append arbitrary SQL clauses. Successful exploitation allows reading sensitive enrollment records, modifying application data, or potentially escalating access depending on database privileges. The attack is launched remotely over the network and requires low-privileged authentication to the admin panel.

Root Cause

The root cause is improper neutralization of user-controlled input within a SQL statement. The application constructs the database query by directly concatenating the Status HTTP parameter rather than using prepared statements or parameterized queries. PHP's mysqli and PDO libraries provide parameter binding, but this code path does not use those safeguards, leaving the query parser exposed to injected syntax.

Attack Vector

An attacker authenticated to the admin panel sends an HTTP request to /admin/enrollment-details.php with a malicious Status value. Typical payloads include UNION SELECT statements for data extraction, boolean-based conditionals for blind injection, or time-based payloads such as SLEEP() to confirm exploitability. Because the exploit has been publicly disclosed, automated scanners and opportunistic actors can readily weaponize the issue. Refer to the GitHub CVE Issue Tracker and VulDB entry #306686 for technical details.

Detection Methods for CVE-2025-4154

Indicators of Compromise

HTTP requests to /admin/enrollment-details.php containing SQL meta-characters such as ', --, UNION, or SLEEP( in the Status parameter.
Unusually long query strings or URL-encoded SQL keywords targeting the admin endpoint.
Database error messages or 500 HTTP responses correlated with admin-area requests.
Unexpected outbound database queries originating from the web server process during admin sessions.

Detection Strategies

Inspect web server access logs for requests to /admin/enrollment-details.php with suspicious Status parameter values.
Enable database query logging and alert on syntactically anomalous statements targeting the enrollment tables.
Deploy a web application firewall (WAF) rule set tuned for SQL injection payloads against PHP admin endpoints.

Monitoring Recommendations

Forward web server, PHP error, and MySQL/MariaDB logs to a centralized SIEM for correlation.
Monitor for repeated authentication failures followed by successful logins to the admin panel, which may indicate credential stuffing prior to exploitation.
Alert on spikes in query latency or row counts retrieved from enrollment tables that could indicate data exfiltration.

How to Mitigate CVE-2025-4154

Immediate Actions Required

Restrict network access to /admin/ paths through IP allowlisting or VPN gating until a patch is available.
Rotate all administrator credentials and enforce strong, unique passwords on the admin panel.
Audit the enrollment database table for unauthorized modifications or recent unusual access patterns.
Deploy a WAF with SQL injection signatures applied to the affected endpoint.

Patch Information

At the time of publication, no vendor patch has been linked in the NVD record. Administrators should monitor the PHPGurukul website for updated releases and apply fixes as they become available. In the interim, organizations should consider replacing vulnerable code paths with parameterized queries or removing the application from internet-facing exposure.

Workarounds

Modify /admin/enrollment-details.php to use parameterized queries via PDO::prepare() or mysqli_prepare() with bound parameters.
Add server-side input validation that restricts the Status parameter to an allowlist of expected values (for example, numeric IDs or fixed status strings).
Disable or remove the affected admin script if the enrollment status functionality is not required.

bash

# Example WAF rule (ModSecurity) blocking SQL injection on the Status parameter
SecRule ARGS:Status "@detectSQLi" \
    "id:1004154,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2025-4154 SQLi attempt on enrollment-details.php',\
    logdata:'Matched Data: %{MATCHED_VAR}'"