CVE-2025-65379

MediumCVSS 6.5

Published: 02/12/2025(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters accept unvalidated user input, which is then concatenated directly into a backend SQL query.

Risk Assessment

An attacker can inject arbitrary SQL queries, potentially leading to data disclosure or modification, and in particular to takeover of the password recovery process and admin account. This may result in full system compromise.

Recommendation

Implement parameterized queries (prepared statements) and input validation in the /admin/password-recovery.php endpoint. Update the application to a patched version if available.

Other vulnerabilities in PHPGurukul Billing System

CVE-2025-65380Medium
PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

Original NVD description (English source)

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS