CVE-2025-6915: PHPGurukul Student Record System SQLi

CVE-2025-6915 Overview

CVE-2025-6915 is a SQL injection vulnerability in PHPGurukul Student Record System 3.2. The flaw resides in the /register.php script, where the session parameter is passed to a backend database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed deployments. The vulnerability is tracked under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact

Authenticated remote attackers can inject SQL through the session parameter in /register.php, potentially exposing or modifying student record data.

Affected Products

• PHPGurukul Student Record System 3.2
• Deployments using cpe:2.3:a:phpgurukul:student_record_system:3.2
• Web applications exposing /register.php to untrusted networks

Discovery Timeline

• 2025-06-30 - CVE-2025-6915 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6915

Vulnerability Analysis

The vulnerability affects the registration endpoint /register.php in PHPGurukul Student Record System 3.2. The session request parameter is concatenated directly into a SQL query string executed against the underlying database. Because the application does not parameterize the query or sanitize user input, an attacker can break out of the intended query context and append arbitrary SQL clauses.

The attack is exploitable over the network and requires low-level privileges, according to the published CVSS 4.0 vector. Successful exploitation can lead to limited disclosure or modification of database records. The EPSS probability score is 0.197% (percentile 41.61), indicating a low near-term exploitation likelihood despite public disclosure.

Root Cause

The root cause is improper neutralization of special characters in the session parameter handled by /register.php. The codebase relies on direct string concatenation rather than prepared statements or parameterized queries. This pattern aligns with CWE-89 and is common in legacy PHP applications that interact with MySQL through deprecated APIs.

Attack Vector

An attacker submits a crafted HTTP request to /register.php with a malicious value in the session parameter. The injected payload alters the query logic, allowing data extraction through techniques such as UNION-based, boolean-based, or time-based blind SQL injection. The attack does not require user interaction and can be automated using common tooling. See the GitHub Issue Report and VulDB entry #314408 for additional technical context.

Detection Methods for CVE-2025-6915

Indicators of Compromise

• HTTP requests to /register.php containing SQL meta-characters such as ', --, UNION, or SLEEP( in the session parameter.
• Unexpected database errors or anomalous response times correlated with requests targeting /register.php.
• Web server access log entries showing repeated probing of the session parameter from a single source.

Detection Strategies

• Deploy WAF rules that flag SQL injection signatures targeting the session parameter on the /register.php endpoint.
• Enable database query logging and alert on syntactically unusual statements originating from the application service account.
• Correlate authentication events with subsequent database errors to identify post-login injection attempts.

Monitoring Recommendations

• Centralize PHP application logs and database error logs in a SIEM for correlation and historical search.
• Baseline normal request patterns for /register.php and alert on parameter values that deviate in length or character composition.
• Monitor outbound database query volumes for spikes that could indicate bulk data extraction.

How to Mitigate CVE-2025-6915

Immediate Actions Required

• Restrict access to /register.php to trusted networks or behind authentication until a patch is applied.
• Deploy WAF signatures that block SQL injection payloads in the session parameter.
• Audit existing database accounts used by the application and revoke unnecessary privileges to limit injection impact.

Patch Information

No vendor advisory or fixed version has been published at the time of writing. Administrators should monitor the PHPGurukul website and the VulDB record for updates. Consider migrating to an actively maintained alternative if the vendor does not release a fix.

Workarounds

• Modify /register.php to use prepared statements via PDO or mysqli with bound parameters for the session value.
• Apply server-side input validation that restricts the session parameter to an expected character set such as alphanumerics.
• Run the database connection under a least-privilege account that cannot execute administrative statements or access unrelated schemas.

# Example mod_security rule blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@streq /register.php" \
  "chain,phase:2,deny,status:403,id:1006915,msg:'CVE-2025-6915 SQLi attempt'"
  SecRule ARGS:session "@detectSQLi" "t:none,t:urlDecodeUni"