CVE-2025-70893
HighSummary
A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fails to properly sanitize user-supplied input provided via the adminname parameter, allowing authenticated attackers to inject arbitrary SQL expressions.
Risk Assessment
An authenticated attacker can exploit this vulnerability to manipulate database queries, potentially leading to unauthorized data access, modification, or system integrity compromise.
Recommendation
It is recommended to immediately apply vendor-provided patches and implement parameterized SQL queries (prepared statements) to eliminate the risk of SQL injection.
Other vulnerabilities in PHPGurukul Cyber Cafe Management System
See all- CVE-2025-70892Critical
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.
- CVE-2023-34666Medium
The Phpgurukul Cyber Cafe Management System version 1.0 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML via the admin username parameter.
Original NVD description (English source)
A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fails to properly sanitize user-supplied input provided via the adminname parameter, allowing authenticated attackers to inject arbitrary SQL expressions.