CVE-2025-7559: Online Fire Reporting System SQLi Flaw

CVE-2025-7559 Overview

CVE-2025-7559 is a SQL injection vulnerability in PHPGurukul Online Fire Reporting System 1.2. The flaw resides in the /admin/bwdates-report-result.php script, where the fromdate and todate parameters are passed unsanitized into a SQL query. Remote authenticated attackers with low privileges can manipulate these date parameters to inject arbitrary SQL statements. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public disclosure of the exploit has occurred through VulDB and a GitHub issue tracker, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Authenticated attackers can extract or modify backend database contents of the Online Fire Reporting System by injecting SQL through date-range report parameters.

Affected Products

PHPGurukul Online Fire Reporting System 1.2
Deployments using cpe:2.3:a:phpgurukul:online_fire_reporting_system:1.2
Administrative report module /admin/bwdates-report-result.php

Discovery Timeline

2025-07-14 - CVE-2025-7559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7559

Vulnerability Analysis

The vulnerability exists in the administrative date-range report functionality of PHPGurukul Online Fire Reporting System 1.2. The bwdates-report-result.php script accepts user-supplied fromdate and todate parameters and concatenates them directly into a backend SQL query without parameterization or input sanitization. An attacker who can authenticate to the admin interface, or reach the endpoint through any access path that exposes it, can inject SQL syntax through these parameters. Successful exploitation allows the attacker to read arbitrary database tables, modify stored fire-incident records, or enumerate credentials and configuration data persisted in the application database. The vulnerability is reachable over the network and does not require user interaction.

Root Cause

The root cause is improper neutralization of special elements in a SQL query string [CWE-74]. The application builds the date-filter query by appending the fromdate and todate request parameters into the SQL statement instead of binding them as parameters through prepared statements. Standard SQL metacharacters such as single quotes, UNION, and comment sequences are interpreted by the database engine, breaking out of the intended date literal context.

Attack Vector

An attacker submits a crafted HTTP request to /admin/bwdates-report-result.php and supplies SQL payloads in the fromdate or todate parameters. Because the application echoes report content back to the requester, both error-based and UNION-based extraction techniques are viable. Time-based blind injection is also feasible where output is suppressed. Public exploit details are referenced in the GitHub Issue Discussion and VulDB #316257 entries.

No verified proof-of-concept code is published in the CVE references; defenders should consult the linked advisories for technical specifics rather than relying on synthetic payloads.

Detection Methods for CVE-2025-7559

Indicators of Compromise

HTTP requests to /admin/bwdates-report-result.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA in fromdate or todate parameters.
Web server access logs showing abnormally long response times for requests to the report endpoint, indicating possible time-based blind injection.
Unexpected database errors or stack traces returned from the bwdates-report-result.php response body.
Outbound database queries referencing system tables originating from the Online Fire Reporting System application user.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string and POST body parameters for SQL injection patterns on PHPGurukul administrative endpoints.
Enable database query auditing to flag queries containing UNION SELECT or INFORMATION_SCHEMA originating from the application service account.
Correlate authentication events with administrative report endpoint access to identify abuse from compromised admin sessions.

Monitoring Recommendations

Forward web server and PHP error logs to a centralized log platform and alert on SQL syntax errors tied to bwdates-report-result.php.
Monitor for first-time or low-frequency source IPs accessing /admin/ paths.
Track outbound data volume from the database host to detect bulk extraction attempts.

How to Mitigate CVE-2025-7559

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a patched version is available.
Audit administrative accounts and rotate credentials, since exploitation requires low-privilege authentication.
Review database contents for unauthorized modifications to fire-incident records or user tables.
Place a WAF rule in blocking mode for SQL metacharacters submitted to fromdate and todate parameters.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-7559 at the time of publication. Operators should monitor the PHP Gurukul Resource site and the VulDB CTI #316257 entry for vendor-released fixes. Until a patch is published, modify the source of bwdates-report-result.php to use parameterized queries (PDO prepared statements or mysqli_stmt_bind_param) for the fromdate and todate inputs.

Workarounds

Implement server-side validation that enforces a strict YYYY-MM-DD date format on fromdate and todate before they reach any SQL statement.
Apply least-privilege database permissions so the application account cannot read system tables or write outside required tables.
Disable or remove the date-range reporting module if it is not in operational use.
Place the application behind a reverse proxy that rejects requests containing SQL metacharacters in date parameters.

bash

# Example ModSecurity rule blocking SQL metacharacters in fromdate/todate
SecRule ARGS:fromdate|ARGS:todate "@rx (['\"]|--|\b(union|select|sleep|benchmark)\b)" \
    "id:1007559,phase:2,deny,status:403,\
    msg:'CVE-2025-7559 SQLi attempt on PHPGurukul Fire Reporting System'"