CVE-2025-7155

Vulnerability

Type and Root Cause

CVE-2025-7155 is an injection vulnerability found in the PHPGurukul Online Notes Sharing System version 1.0. The issue resides in the Cookie Handler component of the /Dashboard endpoint. Manipulating the sessionid cookie value allows an attacker to inject malicious SQL commands, leading to SQL injection. While the original researcher suspected XPath injection, the attack payload is characteristic of SQL injection [2], [3].

Attack

Vector and Requirements

The attack can be performed remotely without prior authentication. An attacker simply sends a crafted HTTP request to the /Dashboard endpoint with a malicious sessionid cookie value. The provided proof-of-concept demonstrates that injecting ' or '1'='1 as the cookie value bypasses authentication and allows access to the dashboard [2], [3]. The application fails to properly sanitize the cookie input before using it in database queries.

Impact

Successful exploitation enables an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data access, authentication bypass, and extraction of sensitive information such as usernames and passwords. Given the critical severity (CVSS 7.3), the vulnerability poses a significant risk to the confidentiality and integrity of the application data.

Mitigation

Status

As of the publication date, no official patch has been released by PHPGurukul. Users are advised to upgrade the system if a security update becomes available or to implement input validation and prepared statements for cookie handling.