SecuriTricks - CVE-2025-2372

Description

A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the file /password-recovery.php of the component Password Recovery Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Product(s) Impacted

Vendor	Product	Versions
Phpgurukul	Hmp Testing Management System	1.0

Weaknesses

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

*CPE(s)

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	phpgurukul	hmp_testing_management_system	1.0	/	/	/	/	/	/	/

References

https://github.com/SECWG/cve/issues/5

https://phpgurukul.com/

https://vuldb.com/?ctiid.299871

https://vuldb.com/?id.299871

https://vuldb.com/?submit.515389

CVSS Score

7.3 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: LOW

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Date

Published: March 17, 2025, 10:15 a.m.
Last Modified: March 17, 2025, 10:15 a.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cna@vuldb.com

CVE-2025-2372