CVE-2025-5554: Rail Pass Management System SQLi Flaw

CVE-2025-5554 Overview

CVE-2025-5554 is a SQL injection vulnerability in PHPGurukul Rail Pass Management System 1.0. The flaw resides in the /admin/pass-bwdates-reports-details.php script, where the fromdate and todate request parameters are passed to a backend SQL query without proper sanitization. An authenticated attacker with low privileges can inject arbitrary SQL statements over the network. The exploit details are publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers can read, modify, or delete backend database records by injecting SQL through the fromdate and todate parameters in the admin date-range report endpoint.

Affected Products

PHPGurukul Rail Pass Management System 1.0
Component: /admin/pass-bwdates-reports-details.php
Vulnerable parameters: fromdate, todate

Discovery Timeline

2025-06-04 - CVE-2025-5554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5554

Vulnerability Analysis

The vulnerability exists in the administrative reporting page pass-bwdates-reports-details.php, which generates pass reports filtered by a user-supplied date range. The fromdate and todate values submitted via the report form are concatenated directly into a SQL query executed against the backend MySQL database. Because the application does not use prepared statements or input validation, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Successful exploitation permits extraction of application data, including passenger records, credentials, and administrative session artifacts stored in the database. Depending on database privileges, attackers may also modify records or use SQL features such as INTO OUTFILE to write files onto the web server.

Root Cause

The root cause is improper neutralization of special elements in the SQL query construction [CWE-74]. User-controlled fromdate and todate parameters are interpolated into the query string rather than being bound as parameters. This anti-pattern is common in legacy PHP applications that build dynamic queries with string concatenation.

Attack Vector

The attack is remote and requires network access to the admin interface and authenticated access at the admin role level. An attacker can submit a crafted POST or GET request to /admin/pass-bwdates-reports-details.php with SQL metacharacters in the fromdate or todate fields. Automated tools such as sqlmap can leverage the disclosed injection point to enumerate the schema and dump tables. Refer to the GitHub issue disclosure and VulDB entry 311006 for public technical details.

Detection Methods for CVE-2025-5554

Indicators of Compromise

HTTP requests to /admin/pass-bwdates-reports-details.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the fromdate or todate parameters.
Web server or PHP error logs showing MySQL syntax errors originating from the reports endpoint.
Unusual outbound traffic or large response sizes from the admin reporting page indicating data exfiltration.
New or modified administrative user records in the admin table without corresponding legitimate activity.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects fromdate and todate parameters for SQL injection patterns.
Enable MySQL general query logging and alert on queries referencing the reports endpoint that contain UNION, SLEEP, or comment sequences.
Correlate admin session activity with sudden spikes in database query volume or errors.

Monitoring Recommendations

Forward web server access logs and MySQL error logs to a centralized SIEM for retention and correlation.
Monitor authentication events on the admin panel to identify brute-force or credential-stuffing precursors to SQL injection abuse.
Baseline normal parameter values for report queries and alert on deviations containing SQL syntax.

How to Mitigate CVE-2025-5554

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or a VPN until a patch is applied.
Rotate all admin credentials and database user passwords in case exploitation has already occurred.
Review database logs and admin activity for signs of prior SQL injection attempts against the reports endpoint.

Patch Information

No official vendor patch has been published by PHPGurukul at the time of NVD publication. Operators should track updates on the PHPGurukul website and the VulDB advisory. Where possible, refactor pass-bwdates-reports-details.php to use parameterized queries via mysqli_prepare() or PDO with bound parameters, and apply strict server-side date validation to fromdate and todate before use.

Workarounds

Apply a WAF virtual patch that blocks SQL metacharacters in the fromdate and todate parameters on the reports endpoint.
Add server-side input validation enforcing a strict YYYY-MM-DD format and reject any request that fails the regular expression check.
Limit the database account used by the application to SELECT privileges on the required tables, removing FILE, INSERT, UPDATE, and DELETE where feasible.
Take the application offline if it is internet-exposed and no compensating controls are available.

bash

# Example Apache mod_security rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/pass-bwdates-reports-details.php" \
  "phase:2,chain,deny,status:403,id:1005554,msg:'CVE-2025-5554 SQLi attempt'"
  SecRule ARGS:fromdate|ARGS:todate "@rx (?i)(union(\s|/\*)+select|sleep\s*\(|--|';|\bor\b\s+1=1)" \
    "t:none,t:urlDecodeUni"