CVE-2025-7561: Online Fire Reporting System SQLi Flaw

CVE-2025-7561 Overview

CVE-2025-7561 is a SQL injection vulnerability in PHPGurukul Online Fire Reporting System version 1.2. The flaw exists in the /admin/team-ontheway-requests.php script, where the teamid parameter is passed directly into a SQL query without sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements against the backend database. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Attackers with low-privilege admin access can extract, modify, or delete records from the underlying database via the teamid parameter.

Affected Products

PHPGurukul Online Fire Reporting System 1.2
Component: /admin/team-ontheway-requests.php
Vulnerable parameter: teamid

Discovery Timeline

2025-07-14 - CVE-2025-7561 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7561

Vulnerability Analysis

The vulnerability resides in the administrative endpoint /admin/team-ontheway-requests.php. This script accepts a teamid argument and incorporates it directly into a SQL query string. Because no parameterized queries or input validation are applied, an attacker can append SQL syntax to the teamid value to alter query logic.

The attack is initiated remotely over the network and requires low-privilege authentication to the admin interface. Successful exploitation gives the attacker the ability to read sensitive records, modify data, or enumerate database structure. According to the Exploit Prediction Scoring System (EPSS), this issue carries a low near-term exploitation probability, but the public disclosure of the technique lowers the technical barrier to attempts.

Root Cause

The root cause is improper neutralization of user-supplied input ([CWE-74]). The teamid parameter is concatenated into a SQL statement without sanitization, type-casting, or prepared-statement binding. Any string a caller submits becomes part of the executed query.

Attack Vector

An authenticated attacker submits a crafted HTTP request to /admin/team-ontheway-requests.php with a malicious teamid value. Payloads typically use boolean-based, error-based, or UNION-based SQL injection techniques to extract data from the application database. The attack requires network reachability to the admin panel and a valid low-privilege session.

No verified proof-of-concept code is published in the referenced advisories. Refer to the GitHub Issue Tracker and VulDB entry #316259 for technical write-ups.

Detection Methods for CVE-2025-7561

Indicators of Compromise

HTTP requests to /admin/team-ontheway-requests.php containing SQL metacharacters in the teamid parameter, such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #).
Unusual database errors logged by the PHP application referencing the teamid query.
Outbound data spikes or slow query patterns from the database server tied to admin sessions.

Detection Strategies

Inspect web server access logs for non-numeric or URL-encoded payloads supplied to the teamid parameter.
Enable MySQL general or slow query logging and alert on queries originating from the team-ontheway-requests.php handler that contain unexpected clauses.
Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures targeting admin endpoints of PHPGurukul applications.

Monitoring Recommendations

Track authentication events for the admin role and correlate sessions with anomalous request volumes to /admin/team-ontheway-requests.php.
Monitor for database schema enumeration patterns such as repeated information_schema references.
Alert on administrative account logins from new IP addresses or geolocations.

How to Mitigate CVE-2025-7561

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a vendor patch is available.
Audit existing admin accounts and rotate credentials, enforcing strong passwords and multi-factor authentication at the reverse proxy layer.
Review application and database logs for prior exploitation attempts against the teamid parameter.

Patch Information

At the time of publication, no official vendor patch has been published for PHPGurukul Online Fire Reporting System 1.2. Monitor the PHPGurukul project site and the GitHub Issue Tracker for fix availability. Organizations relying on this application should plan migration or apply the workarounds below.

Workarounds

Modify /admin/team-ontheway-requests.php to cast teamid to an integer using intval() or use prepared statements with bound parameters via PDO or mysqli.
Deploy a WAF rule blocking SQL metacharacters in the teamid query parameter for this endpoint.
Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and FILE privileges.

bash

# Example WAF rule (ModSecurity) blocking SQLi on the teamid parameter
SecRule REQUEST_URI "@contains /admin/team-ontheway-requests.php" \
    "chain,deny,status:403,id:1007561,msg:'CVE-2025-7561 SQLi attempt'"
  SecRule ARGS:teamid "@detectSQLi" \
    "t:none,t:urlDecodeUni"