CVE-2025-65380
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query.
Risk Assessment
An attacker can inject arbitrary SQL queries, potentially leading to disclosure, modification, or deletion of database data and authentication bypass. This may result in full system compromise.
Recommendation
Implement parameterized queries (prepared statements) and input validation in the admin/index.php endpoint. Update the application to a patched version if available.
Other vulnerabilities in PHPGurukul Billing System
Original NVD description (English source)
PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS