CVE-2025-4156: Boat Booking System SQLi Vulnerability

CVE-2025-4156 Overview

CVE-2025-4156 is a SQL injection vulnerability in PHPGurukul Boat Booking System 1.0. The flaw resides in /admin/change-image.php, where the ID parameter is passed unsanitized into a backend SQL query. Authenticated attackers with low privileges can manipulate the parameter to inject arbitrary SQL statements over the network. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments. The vulnerability is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can inject SQL statements through the ID parameter in /admin/change-image.php, exposing database contents and potentially enabling data tampering in the Boat Booking System backend.

Affected Products

PHPGurukul Boat Booking System 1.0
Deployments using the /admin/change-image.php endpoint
Installations exposing the admin interface to untrusted networks

Discovery Timeline

2025-05-01 - CVE-2025-4156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4156

Vulnerability Analysis

The vulnerability affects the administrative image change functionality in PHPGurukul Boat Booking System 1.0. The script /admin/change-image.php accepts an ID parameter from the HTTP request and concatenates it directly into a SQL query without parameterization or input validation. This pattern is a textbook [CWE-89] SQL injection condition.

The attacker requires low-privileged authenticated access to reach the admin endpoint. Once authenticated, the attacker submits crafted values in the ID parameter to alter query logic. Depending on the underlying database driver, the attacker can extract data using UNION-based, error-based, or boolean-blind techniques. The EPSS score is 0.342% with a percentile of 25.97, indicating low but non-zero predicted exploitation activity.

Root Cause

The root cause is direct interpolation of user-supplied input into a SQL statement within change-image.php. The application does not use prepared statements, parameterized queries, or input sanitization. Any string supplied as ID is treated as a fragment of the SQL command rather than as a data value.

Attack Vector

The attack is initiated remotely over the network against the admin interface. The attacker sends an HTTP request to /admin/change-image.php with a malicious ID value, for example appending logical operators or UNION SELECT clauses. Successful exploitation can read arbitrary tables, including credentials and booking records, and may permit modification of records if the injected statement allows writes.

No verified proof-of-concept code is published in the references. The technical details are tracked in the GitHub Issue Tracker CVE and VulDB #306688.

Detection Methods for CVE-2025-4156

Indicators of Compromise

HTTP requests to /admin/change-image.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or OR 1=1 in the ID parameter.
Unexpected database errors logged by PHP or MySQL referencing change-image.php.
Admin sessions originating from unusual IP ranges accessing the image change endpoint repeatedly.

Detection Strategies

Inspect web server access logs for GET or POST requests to /admin/change-image.php where the ID parameter deviates from numeric values.
Deploy a web application firewall (WAF) signature for SQL injection patterns targeting the ID query string parameter.
Correlate authentication events with subsequent SQL errors to identify post-login injection probes.

Monitoring Recommendations

Enable verbose query logging on the MySQL backend and alert on syntax errors tied to admin endpoints.
Monitor file integrity on PHPGurukul installation directories to detect unauthorized changes following exploitation.
Track outbound database traffic volume for anomalies consistent with bulk data extraction.

How to Mitigate CVE-2025-4156

Immediate Actions Required

Restrict access to /admin/ paths using IP allowlists or VPN-only access until a vendor patch is applied.
Audit administrative accounts and rotate credentials that may have been exposed through database queries.
Review database logs for evidence of injection attempts dating back to the publication date of May 1, 2025.

Patch Information

At the time of publication, no vendor advisory or patched release is listed in the references. Administrators should monitor PHP Gurukul for an updated version of Boat Booking System and apply it once available. Until then, treat all version 1.0 installations as vulnerable.

Workarounds

Modify change-image.php to cast the ID parameter to an integer using intval() before use in any SQL statement.
Replace inline SQL with prepared statements using PDO or mysqli with bound parameters.
Place the application behind a WAF configured with OWASP CRS rules for SQL injection protection.
Disable or remove the admin image change feature if it is not required in production.

bash

# Configuration example: minimal Apache rule to block obvious SQLi patterns on the vulnerable endpoint
<Location "/admin/change-image.php">
    SetEnvIfNoCase Query_String "(union.*select|select.*from|or\s+1=1|--|;)" block_sqli
    Require all granted
    Require not env block_sqli
</Location>