github.comexploitissue tracking
https://github.com/l8BL/vul_report/issues/2 CVE-2025-2473
MEDIUMNuclei
PHPGurukul Company Visitor Management System Sign In index.php sql injection
Record summary
CVE-2025-2473 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 18, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Company Visitor Management SystemBrowse PHPGurukul / Company Visitor Management System | CVE List | 2.0 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALCompany Visitor Management System 1.0 - SQL InjectionCVSS 10
Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
Impact
Unauthenticated attackers can bypass authentication and execute arbitrary SQL queries through the username parameter, potentially gaining administrative access and extracting sensitive visitor and company information.
Remediation
Apply input validation patches or upgrade to a patched version that properly sanitizes SQL input.
WeaknessesCWE-89
Authorsarafatansari
Template tagscvecve2025cvmssqliauth-bypasscmsedbpacketstormvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
https://www.exploit-db.com/exploits/48884 https://packetstormsecurity.com/files/158476/Company-Visitor-Management-System-CVMS-1.0-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2025-2473
Source: ProjectDiscovery
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-2473 phpgurukul.comproduct
https://phpgurukul.com/ VDB-299966 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.299966 VDB-299966 | PHPGurukul Company Visitor Management System Sign In index.php sql injectionvdb entryTechnical description
https://vuldb.com/?id.299966 Submit #517266 | PHPGurukul Company Visitors Management System using PHP and MySQL V2.0 SQL InjectionThird-party advisory
https://vuldb.com/?submit.517266