PT-2025-26288 · Unknown · Phpgurukul Pre-School Enrollment System

F1Rstb100D · Published 2025-06-20 · Updated 2025-06-21 · CVE-2025-6318

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Pre-School Enrollment System version 1.0

Description A critical issue was found in the PHPGurukul Pre-School Enrollment System. This issue affects the /admin/check availability.php file and is related to the manipulation of the Username argument, which leads to SQL injection. The attack can be initiated remotely. An exploit for this issue has been publicly disclosed and may be used.

Recommendations For PHPGurukul Pre-School Enrollment System version 1.0, consider disabling the check availability.php file in the /admin directory until a patch is available to prevent SQL injection attacks through the Username argument. Restrict access to the /admin/check availability.php endpoint to minimize the risk of exploitation. Avoid using the Username argument in the affected endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-6318

Affected Products

Phpgurukul Pre-School Enrollment System

References · 12

• 🔥 https://github.com/f1rstb100d/myCVE/issues/71 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6318 · Security Note
• https://vuldb.com/?ctiid.313318 · Note
• https://phpgurukul.com · Note
• https://twitter.com/CVEnew/status/1936472556959121798 · Twitter Post
• https://t.me/latest_high_impact_cve/2734 · Telegram Post
• https://t.me/cvetracker/26633 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1935987981837283353 · Twitter Post
• https://vuldb.com/?id.313318 · Note
• https://vuldb.com/?submit.596065 · Note
• https://t.me/cvenotify/126225 · Telegram Post