CVE-2025-8431

Vulnerability

Overview

A critical SQL injection vulnerability exists in PHPGurukul Boat Booking System version 1.0, specifically in the /admin/add-boat.php file. The boatname parameter is directly concatenated into SQL queries without proper sanitization or validation, enabling attackers to inject malicious SQL statements [2]. This flaw is classified as critical with a CVSS v3 score of 7.3.

Exploitation

Details

The vulnerability can be exploited remotely without requiring authentication or prior authorization [2]. An attacker can craft a POST request to /admin/add-boat.php with a malicious boatname parameter containing SQL injection payloads. The provided proof-of-concept demonstrates time-based blind SQL injection using MySQL's SLEEP function, allowing attackers to extract data even without direct output [2].

Impact

Successful exploitation grants attackers unauthorized access to the underlying database. This can lead to sensitive data leakage, data tampering, and potential full system compromise. The attacker may also disrupt services by modifying or deleting critical data [2].

Mitigation

As of the publication date, no official patch has been released. The vendor's website (PHPGurukul) provides general guidance on using PDO for secure database interactions [1], but the affected application does not implement such measures. Users should apply input validation and parameterized queries immediately, or consider migrating to a secure alternative.