CVE-2025-6913: Phpgurukul Student Record System SQLi

CVE-2025-6913 Overview

CVE-2025-6913 is a SQL injection vulnerability in PHPGurukul Student Record System version 3.2. The flaw resides in the /admin-profile.php script, where the aemailid parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate this argument to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed instances. The weakness is categorized under [CWE-74], improper neutralization of special elements in output used by a downstream component.

Critical Impact

Remote attackers with low-privileged access can inject SQL commands through the aemailid parameter, potentially compromising the integrity and confidentiality of stored student records.

Affected Products

• PHPGurukul Student Record System 3.2
• CPE: cpe:2.3:a:phpgurukul:student_record_system:3.2:*:*:*:*:*:*:*
• Component: phpgurukul:student_record_system

Discovery Timeline

• 2025-06-30 - CVE-2025-6913 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6913

Vulnerability Analysis

The vulnerability affects the admin profile management functionality of PHPGurukul Student Record System 3.2. The /admin-profile.php script accepts user-controlled input through the aemailid parameter. This parameter flows into a SQL query without proper escaping or parameterization. An attacker can supply crafted input containing SQL metacharacters to alter the structure of the underlying query.

Successful exploitation can expose data stored in the application's database, including administrator credentials and student records. The attack is performed remotely over the network and requires only low-level privileges on the application.

Root Cause

The root cause is improper neutralization of special elements in a downstream component [CWE-74]. The admin-profile.php script concatenates the aemailid parameter directly into a SQL statement instead of using prepared statements or parameterized queries. This design flaw allows attacker-controlled syntax to be interpreted as part of the query.

Attack Vector

The attack is delivered over the network against the application's admin profile endpoint. An attacker with valid low-privilege credentials submits a malicious payload through the aemailid form field or HTTP parameter. The injected SQL is executed by the backend database, returning data or performing actions outside the intended query scope. The exploit has been disclosed publicly, lowering the barrier to weaponization. Refer to the GitHub Issue Discussion and VulDB #314406 for technical references.

Detection Methods for CVE-2025-6913

Indicators of Compromise

• HTTP POST or GET requests to /admin-profile.php containing SQL metacharacters (single quotes, UNION, SELECT, --, OR 1=1) in the aemailid parameter.
• Unusual database error messages returned by the application following requests to admin-profile.php.
• Unexpected outbound queries or large result sets originating from the application database user.

Detection Strategies

• Inspect web server access logs for anomalous query strings or POST bodies targeting admin-profile.php.
• Deploy web application firewall (WAF) signatures that flag SQL injection patterns against the aemailid parameter.
• Enable database query auditing to identify malformed or unusually long queries originating from the application account.

Monitoring Recommendations

• Monitor authentication logs for suspicious admin session activity preceding requests to admin-profile.php.
• Alert on repeated 500-level HTTP responses from the admin profile endpoint, which may indicate injection probing.
• Track database read volume from the application user to detect bulk data extraction attempts.

How to Mitigate CVE-2025-6913

Immediate Actions Required

• Restrict access to the /admin-profile.php endpoint to trusted networks or VPN-only access until a fix is applied.
• Rotate administrator credentials and review database accounts used by the application for excessive privileges.
• Review web server and database logs for prior exploitation attempts referencing the aemailid parameter.

Patch Information

No official vendor patch has been published in the available references at the time of writing. Operators of PHPGurukul Student Record System 3.2 should monitor the PHP Gurukul website for security updates and consult the VulDB entry for any subsequent remediation guidance.

Workarounds

• Apply input validation that rejects SQL metacharacters in the aemailid parameter before it reaches the database layer.
• Refactor the affected query in admin-profile.php to use parameterized statements or prepared queries with PDO or mysqli.
• Deploy a WAF rule to block SQL injection payloads targeting the admin profile endpoint.
• Run the application database account with least privilege, removing write or schema-modification rights where not required.

# Example WAF rule snippet (ModSecurity) to block SQLi in aemailid
SecRule ARGS:aemailid "@detectSQLi" \
    "id:1006913,phase:2,deny,status:403,\
     msg:'Possible SQLi against admin-profile.php (CVE-2025-6913)',\
     logdata:'Matched value: %{MATCHED_VAR}'"