PT-2025-8727 · Unknown · Phpgurukul Land Record System Project

Published 2025-02-26 · Updated 2025-03-08 · CVE-2025-25462

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PHPGurukul Land Record System Project version 1.0

Description A SQL Injection issue was discovered in the /admin/add-propertytype.php file, allowing remote attackers to execute arbitrary code via the propertytype POST request parameter in the PHP v1.0 version of the system.

Recommendations For version 1.0, consider restricting access to the /admin/add-propertytype.php file and avoid using the propertytype parameter in the affected POST request until a fix is available. As a temporary workaround, disabling the execution of arbitrary code via the propertytype parameter can help minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-25462

Affected Products

Phpgurukul Land Record System Project

References · 5

• 🔥 https://github.com/terrasystemlabs/CVE-IDs/blob/main/PHP-Gurukul/Land-record/Land_SQL_Injection.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2025-25462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25462 · Security Note
• https://t.me/cvedetector/18948 · Telegram Post
• https://twitter.com/CVEnew/status/1898276778931814788 · Twitter Post