CVE-2025-5653: PHPGurukul Complaint Management SQLI Flaw

CVE-2025-5653 Overview

CVE-2025-5653 is a SQL injection vulnerability in PHPGurukul Complaint Management System 2.0. The flaw resides in the /admin/between-date-userreport.php script, where the fromdate and todate parameters are passed to a database query without proper sanitization. An authenticated attacker can manipulate these parameters to inject arbitrary SQL statements. The attack is remotely exploitable over the network and requires low privileges. The exploit details have been publicly disclosed, which increases the likelihood of opportunistic exploitation against exposed installations. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can inject SQL commands through the date-range report function, enabling unauthorized read and write access to the underlying database.

Affected Products

PHPGurukul Complaint Management System 2.0
Component: /admin/between-date-userreport.php
Vulnerable parameters: fromdate and todate

Discovery Timeline

2025-06-05 - CVE-2025-5653 published to NVD
2025-06-10 - Last updated in NVD database

Technical Details for CVE-2025-5653

Vulnerability Analysis

The vulnerability exists in the administrative reporting module of PHPGurukul Complaint Management System 2.0. The between-date-userreport.php file accepts user-supplied fromdate and todate HTTP parameters and concatenates them directly into a SQL query. Because the application does not use parameterized statements or validate the date format, an attacker can break out of the intended string context and append arbitrary SQL clauses. Successful exploitation allows extraction of administrator credentials, complainant data, and other records stored in the application database. The attack requires an authenticated admin-area session, but PHPGurukul applications historically ship with weak default credentials, lowering the effective barrier.

Root Cause

The root cause is improper neutralization of special elements within a SQL query [CWE-74]. The application trusts the fromdate and todate request parameters and inserts them into a BETWEEN clause without escaping single quotes, comment markers, or SQL keywords. PHP's mysqli or legacy mysql_* functions are invoked with concatenated strings rather than prepared statements.

Attack Vector

An attacker authenticated to the admin panel issues a crafted POST or GET request to /admin/between-date-userreport.php containing SQL payloads in the fromdate or todate fields. A typical payload terminates the date string with a single quote, injects a UNION SELECT statement to exfiltrate columns from the tbladmin or tblcomplaint tables, and comments out the trailing SQL. Time-based blind injection using SLEEP() is also feasible because the endpoint accepts unsanitized input directly into the query.

// Vulnerability described in prose only.
// No verified proof-of-concept code is available for CVE-2025-5653.
// See the referenced GitHub issue and VulDB entry for technical specifics.

Detection Methods for CVE-2025-5653

Indicators of Compromise

Web server access logs containing requests to /admin/between-date-userreport.php with SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in fromdate or todate parameters.
Unexpected MySQL errors or long query response times originating from the reporting endpoint.
New or modified rows in the tbladmin table, or unexplained data exports from complaint tables.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string and POST body parameters for SQL injection signatures targeting date fields.
Enable MySQL general query logging and alert on queries containing UNION SELECT against the complaint management schema.
Correlate authenticated admin sessions with anomalous request volume to /admin/between-date-userreport.php.

Monitoring Recommendations

Monitor outbound traffic from the web server for unusual data volumes that may indicate database exfiltration.
Track failed and successful admin login events alongside report-generation requests to identify brute-force precursors.
Review the GitHub issue tracking this CVE and VulDB entry #311143 for payload patterns used in public disclosures.

How to Mitigate CVE-2025-5653

Immediate Actions Required

Restrict access to the /admin/ directory using IP allowlisting or network-layer controls until a patched version is available.
Rotate all administrative credentials and audit existing admin accounts for unauthorized additions.
Inspect the database for evidence of unauthorized read or write activity originating from the report endpoint.

Patch Information

No official vendor patch has been published by PHPGurukul at the time of CVE assignment. Operators should monitor the PHPGurukul website for security updates and apply any future release that addresses the between-date-userreport.php injection point.

Workarounds

Modify /admin/between-date-userreport.php to use prepared statements with bound parameters via mysqli_prepare() and bind_param().
Add server-side validation that enforces a strict YYYY-MM-DD format on fromdate and todate before they reach the SQL layer.
Deploy a WAF rule blocking SQL metacharacters in the affected parameters as a compensating control.

bash

# Example Apache configuration to restrict admin access by source IP
<Location "/admin/between-date-userreport.php">
    Require ip 10.0.0.0/24
    Require ip 192.168.1.0/24
</Location>