CVE-2025-8951

Vulnerability

Analysis

A SQL injection vulnerability has been identified in PHPGurukul Teachers Record Management System version 2.1. The flaw resides in the /admin/search.php file, where the searchdata parameter is processed. The root cause is the lack of proper sanitization or parameterized queries; user-supplied input is directly concatenated into SQL statements, enabling an attacker to manipulate database queries [2].

Exploitation

This vulnerability can be exploited remotely without requiring authentication or prior authorization [2]. An attacker can send a crafted POST request to the vulnerable endpoint, injecting malicious SQL payloads via the searchdata parameter. The exploit has been publicly disclosed, increasing the risk of widespread attacks [2].

Impact

Successful exploitation allows an attacker to perform time-based blind SQL injection, potentially extracting sensitive data, modifying or deleting records, and gaining unauthorized control over the database. This could lead to complete compromise of the application and underlying data, posing a severe threat to confidentiality, integrity, and availability [2].

Mitigation

As of the publication date, no official patch has been released by the vendor. The vendor's website provides general guidance on using PDO for secure database interactions [1], but the affected product remains unpatched. Users should apply input validation and use prepared statements as a workaround, or consider discontinuing use of the system until a fix is available.