CVE-2025-7160

MEDIUMNuclei

PHPGurukul Zoo Management System index.php sql injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-7160 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zoo Management System

Browse PHPGurukul / Zoo Management System
CVE List2.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALZoo Management System 1.0 - SQL InjectionCVSS 10

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can bypass authentication and execute arbitrary SQL queries through the username parameter, potentially gaining full administrative access and extracting sensitive database information.

Remediation

Upgrade Zoo Management System to a patched version that properly sanitizes user input in the login form.

WeaknessesCWE-89
Authorsarafatansari
Template tagscvecve2025edbpacketstormzmssqliauth-bypasscmsvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
https://www.exploit-db.com/exploits/48880 https://packetstormsecurity.com/files/167572/Zoo-Management-System-1.0-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2025-7160

Source: ProjectDiscovery

References

6