PT-2025-35564 · Phpgurukul · Phpgurukul Employee Leaves Management System

Rishb0 · Published 2025-09-02 · Updated 2025-09-04 · CVE-2025-56254

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Employee Leave Management System version 2.1

Description The software contains an Insecure Direct Object Reference (IDOR) vulnerability in the leave-details.php file. An authenticated user can modify the leaveid parameter within the URL to gain unauthorized access to leave application details belonging to other users.

Recommendations Ensure that access to leave application details is properly restricted based on user authentication and authorization. Implement robust input validation and sanitization for the leaveid parameter to prevent manipulation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-56254

Affected Products

Phpgurukul Employee Leaves Management System

References · 6

• 🔥 https://github.com/rishb0/CVEs-Assigned/blob/main/CVE-2025-56254.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-56254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56254 · Security Note
• https://t.me/cveNotify/134288 · Telegram Post
• https://twitter.com/CVEnew/status/1962855584467652786 · Twitter Post
• https://t.me/CVEtracker/31506 · Telegram Post