CVE-2025-6319: Pre-school Enrollment System SQLi Flaw

CVE-2025-6319 Overview

CVE-2025-6319 is a SQL injection vulnerability in PHPGurukul Pre-School Enrollment System 1.0. The flaw resides in the /admin/add-teacher.php script, where the tsubject parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can manipulate the tsubject parameter in /admin/add-teacher.php to execute arbitrary SQL queries against the backend database, potentially exposing or modifying enrollment records.

Affected Products

PHPGurukul Pre-School Enrollment System 1.0
Component: /admin/add-teacher.php
CPE: cpe:2.3:a:phpgurukul:pre-school_enrollment_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-06-20 - CVE-2025-6319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6319

Vulnerability Analysis

The vulnerability exists in the administrative teacher creation workflow of PHPGurukul Pre-School Enrollment System 1.0. The add-teacher.php endpoint accepts a tsubject POST parameter and concatenates the value into a SQL statement without parameterization or escaping. An attacker who has access to the admin panel can submit crafted input that breaks out of the intended query context and appends attacker-controlled SQL. Successful exploitation enables reading, modifying, or deleting data stored in the application database. The PHPGurukul project is a collection of free PHP learning applications and is not typically deployed in production, but instances are routinely found exposed on the public internet.

Root Cause

The root cause is improper neutralization of special elements in a SQL query [CWE-74]. The tsubject argument is interpolated directly into the database query rather than being bound through a prepared statement. There is no allow-list validation, type coercion, or escaping applied before query execution. This pattern is consistent across multiple PHPGurukul applications and reflects a systemic absence of parameterized queries in administrative scripts.

Attack Vector

Exploitation requires network access to the application and authenticated low-privilege admin access to reach /admin/add-teacher.php. The attacker submits a POST request containing a malicious payload in the tsubject field. Typical payloads use UNION-based or boolean-based techniques to extract data from the underlying MySQL database. No user interaction is required beyond the attacker's own request submission. Public disclosure of the issue means automated scanners and exploit tooling can readily identify and target vulnerable installations.

No verified proof-of-concept code is provided in this advisory. For technical specifics, see the GitHub Issue Discussion and VulDB entry #313319.

Detection Methods for CVE-2025-6319

Indicators of Compromise

HTTP POST requests to /admin/add-teacher.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or OR 1=1 in the tsubject parameter.
Web server access logs showing repeated requests to add-teacher.php from a single source with varying payload sizes.
Unexpected entries in the teachers table or anomalous read/write activity against the enrollment database.
Outbound database errors or stack traces returned to clients indicating broken SQL syntax.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST parameters to administrative PHP scripts for SQL injection signatures.
Enable MySQL general query logging during incident response to correlate suspicious queries with HTTP requests.
Monitor for HTTP 500 responses or database error messages emitted by add-teacher.php, which often accompany injection probing.

Monitoring Recommendations

Alert on any access to /admin/ paths from non-allowlisted IP ranges.
Track failed admin authentication attempts followed by successful logins, as credential stuffing often precedes exploitation of authenticated SQLi flaws.
Forward web server, PHP, and database logs to a centralized SIEM for correlation against known SQL injection patterns.

How to Mitigate CVE-2025-6319

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allow-lists or VPN-only access.
Rotate all administrative credentials for the enrollment system and enforce strong, unique passwords.
Audit the teachers and user tables for unauthorized entries or modifications since June 2025.
Place the application behind a WAF configured to block SQL injection payloads in POST bodies.

Patch Information

No official vendor patch has been published for CVE-2025-6319 at the time of the latest NVD update. Organizations running PHPGurukul Pre-School Enrollment System 1.0 should consider decommissioning the application or migrating to a maintained alternative. Monitor the PHPGurukul website for any subsequent fixes.

Workarounds

Modify add-teacher.php to use PDO or mysqli prepared statements with bound parameters for the tsubject field and all other user-controlled inputs.
Apply server-side input validation that constrains tsubject to an expected character set, such as alphanumerics and spaces.
Disable the public-facing admin interface if it is not actively required for operations.
Take the application offline if it is exposed to untrusted networks and no compensating controls can be applied.

bash

# Example Apache configuration to restrict /admin/ to a trusted subnet
<Directory "/var/www/html/admin">
    Require ip 10.0.0.0/24
    Require all denied
</Directory>