CVE-2025-7534

Root

Cause

The vulnerability resides in the notice-details.php file of PHPGurukul Student Result Management System 2.0 [1]. The application directly concatenates the user-supplied nid GET parameter into an SQL query without any sanitization or parameterized binding [2]. The code snippet $sql = "SELECT * from tblnotice where id='$noticeid'"; shows the lack of prepared statements, making it susceptible to SQL injection [2].

Exploitation

An attacker can exploit this flaw remotely without authentication by sending a crafted HTTP request to /notice-details.php?nid=... [2]. Both time-based blind injection (e.g., using SLEEP()) and UNION-based injection are possible, allowing the attacker to extract data from the database [2]. Public proof-of-concept payloads and automated tools like sqlmap have been demonstrated [2].

Impact

Successful exploitation grants unauthorized access to all database contents, including sensitive student records and admin credentials [2]. This can lead to privilege escalation, full database extraction, and potential administrative takeover of the application [2].

Mitigation

As of the publication date, no official patch has been released by PHPGurukul [1]. The vendor is advised to implement parameterized queries using PDO or MySQLi prepared statements to prevent SQL injection [1]. Given that the exploit is publicly available, administrators should apply input validation and consider disabling the vulnerable endpoint until a fix is deployed.