CVE-2025-5546: Daily Expense Tracker System SQLi Flaw

CVE-2025-5546 Overview

CVE-2025-5546 is a SQL injection vulnerability in PHPGurukul Daily Expense Tracker System 1.1. The flaw resides in /expense-reports-detailed.php, where the fromdate and todate parameters are passed to backend SQL queries without proper sanitization. Attackers can manipulate these parameters to inject arbitrary SQL statements and interact with the underlying database. The vulnerability requires network access and low-privileged authentication, but no user interaction. Public disclosure of the exploit increases the likelihood of opportunistic abuse against exposed installations. The issue is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated attackers can inject SQL into the fromdate and todate parameters of /expense-reports-detailed.php, exposing stored expense records and potentially modifying database contents.

Affected Products

PHPGurukul Daily Expense Tracker System 1.1
CPE: cpe:2.3:a:phpgurukul:daily_expense_tracker_system:1.1
Component: phpgurukul:daily_expense_tracker_system

Discovery Timeline

2025-06-04 - CVE-2025-5546 published to NVD
2025-06-10 - Last updated in NVD database

Technical Details for CVE-2025-5546

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP web application. The script /expense-reports-detailed.php accepts two date parameters, fromdate and todate, used to filter expense report queries. These parameters are concatenated directly into a SQL statement without parameterized queries or input validation. An attacker submitting crafted values can break out of the intended query context and append arbitrary SQL clauses.

Successful exploitation lets an attacker read, modify, or delete records in the expense tracker database. Depending on database permissions, the attacker may extract user credentials, manipulate financial records, or pivot to other tables. The exploit has been publicly disclosed via a GitHub issue report and documented in VulDB entry #310996.

Root Cause

The root cause is improper neutralization of user-supplied input before constructing SQL queries. The application trusts the fromdate and todate HTTP parameters and passes them directly to the database layer. No prepared statements, type casting to date objects, or allowlist validation are applied prior to query execution.

Attack Vector

The attack vector is network-based and requires an authenticated session in the expense tracker application. After authentication, the attacker submits a crafted HTTP request to /expense-reports-detailed.php with malicious SQL payloads embedded in the fromdate or todate parameters. No user interaction by other users is required. The exploit can be automated using standard SQL injection tooling against the reporting endpoint. Refer to the VulDB CTI entry for technical context.

Detection Methods for CVE-2025-5546

Indicators of Compromise

Web server access logs containing requests to /expense-reports-detailed.php with SQL meta-characters such as ', --, UNION, SELECT, or SLEEP( in the fromdate or todate parameters.
Unexpected database errors, time delays, or anomalously large response sizes from the reporting endpoint.
Outbound database connections or queries originating from low-privileged accounts that touch tables outside the expense schema.

Detection Strategies

Deploy web application firewall rules that inspect query string and POST parameters submitted to /expense-reports-detailed.php for SQL injection patterns.
Enable database query logging and alert on syntactically malformed queries or queries that reference system tables such as information_schema.
Correlate authentication events with reporting endpoint access to flag low-privileged accounts running unusual query volumes.

Monitoring Recommendations

Forward web server, PHP error, and MySQL logs to a centralized analytics platform for retroactive hunting.
Track baseline request rates for /expense-reports-detailed.php and alert on spikes consistent with automated injection probing.
Monitor for new or modified accounts in the expense tracker database following suspicious requests.

How to Mitigate CVE-2025-5546

Immediate Actions Required

Restrict access to the Daily Expense Tracker System to trusted networks or VPN until a patch is available.
Audit existing user accounts and reset credentials for any account that interacted with /expense-reports-detailed.php during suspect periods.
Place the application behind a web application firewall configured with SQL injection signatures.

Patch Information

At the time of publication, the vendor PHPGurukul has not released a security patch addressing CVE-2025-5546. Monitor the PHPGurukul homepage and the originating GitHub issue for vendor updates. Operators should apply source-level fixes by replacing concatenated SQL with parameterized queries using PDO or MySQLi prepared statements and by enforcing strict date format validation on fromdate and todate.

Workarounds

Modify /expense-reports-detailed.php to validate fromdate and todate against a strict YYYY-MM-DD regular expression before any database use.
Refactor the affected SQL query to use prepared statements with bound parameters instead of string concatenation.
Restrict the database account used by the application to read-only access on the expense tables where business logic permits.

bash

# Example Apache configuration to block obvious SQL injection patterns
# against the vulnerable endpoint until source-level fixes are deployed
<Location "/expense-reports-detailed.php">
    SetEnvIfNoCase Request_URI "(union|select|sleep\(|information_schema|--|')" sqli_attempt
    Require all granted
    <RequireAll>
        Require all granted
        Require not env sqli_attempt
    </RequireAll>
</Location>