CVE-2025-7584: PHPGurukul Fire Reporting System SQLi Flaw

CVE-2025-7584 Overview

CVE-2025-7584 is a SQL injection vulnerability in PHPGurukul Online Fire Reporting System version 1.2. The flaw resides in /admin/add-team.php, where the teammember parameter is passed to a database query without proper sanitization. Attackers with low-privilege administrative access can manipulate the parameter to inject arbitrary SQL statements over the network. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject SQL through the teammember parameter to read, modify, or delete backend database records remotely.

Affected Products

PHPGurukul Online Fire Reporting System 1.2
Component: /admin/add-team.php
Vendor: PHPGurukul

Discovery Timeline

2025-07-14 - CVE-2025-7584 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7584

Vulnerability Analysis

The vulnerability affects the administrative team management functionality of PHPGurukul Online Fire Reporting System 1.2. The add-team.php script accepts a teammember argument from an HTTP request and concatenates the value directly into a SQL statement. Because the value is not parameterized or sanitized, an attacker can break out of the intended query context and append arbitrary SQL syntax.

Successful exploitation allows the attacker to read arbitrary tables, modify records, or extract credentials stored in the backend database. The affected endpoint is located within the /admin/ directory, requiring valid administrative session credentials, which limits exposure to scenarios where attackers already possess admin access or where weak credentials are in place.

The issue is tracked publicly through VulDB entry #316283 and a corresponding GitHub issue discussion. EPSS data lists the exploit prediction at 0.318%.

Root Cause

The root cause is improper neutralization of user-controlled input before its inclusion in a SQL query. The teammember request parameter reaches the database layer without prepared statements or input validation, allowing SQL syntax injection into the underlying query executed by add-team.php.

Attack Vector

The attack is initiated remotely over HTTP against the administrative interface. An authenticated attacker submits a crafted teammember value containing SQL metacharacters through the team-addition form. The application constructs and executes the malformed query, returning results or performing operations directed by the injected payload. No user interaction beyond the attacker is required.

Since the exploit has been publicly disclosed, opportunistic scanning for exposed PHPGurukul installations is a realistic concern. See the VulDB CTI record for additional threat intelligence context.

Detection Methods for CVE-2025-7584

Indicators of Compromise

HTTP POST requests to /admin/add-team.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the teammember parameter.
Unexpected database error messages logged by PHP or the web server following requests to add-team.php.
New or modified administrative accounts and team records that do not correspond to legitimate activity.

Detection Strategies

Inspect web server access logs for anomalous teammember parameter values submitted to /admin/add-team.php.
Deploy web application firewall (WAF) rules that flag common SQL injection patterns targeting form parameters on PHPGurukul endpoints.
Correlate authenticated admin sessions with unusual query volumes or long-running database operations originating from the fire reporting application.

Monitoring Recommendations

Enable MySQL general query logging temporarily to review queries generated by add-team.php for injection attempts.
Alert on failed login bursts against /admin/ followed by successful access, indicating credential compromise that could enable exploitation.
Track outbound network traffic from the database host to detect data exfiltration following successful injection.

How to Mitigate CVE-2025-7584

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlisting or VPN-only access until a patch is available.
Rotate all administrative credentials for the Online Fire Reporting System to invalidate any previously exposed sessions.
Review team and user tables for unauthorized entries created via the vulnerable endpoint.

Patch Information

At the time of publication, no official vendor patch has been referenced in the NVD advisory. Monitor the PHPGurukul website for security updates addressing the add-team.php SQL injection. Organizations should track the VulDB submission for updates on remediation status.

Workarounds

Apply a virtual patch at the WAF layer that blocks requests to /admin/add-team.php containing SQL metacharacters in the teammember parameter.
Modify the vulnerable script locally to use prepared statements with parameter binding via mysqli_prepare() or PDO with bindParam().
Disable the team management feature or remove the add-team.php file if the functionality is not required in production.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in teammember parameter
SecRule ARGS:teammember "@rx (?i)(union(.*?)select|sleep\(|--|';)" \
    "id:1007584,phase:2,deny,status:403,\
    msg:'CVE-2025-7584 SQLi attempt against add-team.php'"