CVE-2025-2034 in Pre-School Enrollment System
Summary
by MITRE • 03/06/2025
A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-class.php?cid=1. The manipulation of the argument classname/capacity/classtiming leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/22/2025
This critical vulnerability in PHPGurukul Pre-School Enrollment System version 1.0 represents a severe sql injection flaw that compromises the system's database integrity and confidentiality. The vulnerability specifically affects the administrative functionality within the /admin/edit-class.php file where the cid parameter is processed. When an attacker manipulates the classname, capacity, or classtiming parameters, the application fails to properly sanitize user input before incorporating it into database queries, creating an exploitable condition that allows malicious actors to execute arbitrary sql commands.
The technical nature of this vulnerability aligns with CWE-89 which categorizes sql injection as a fundamental flaw in web application security where untrusted data is directly included in sql command construction without proper validation or escaping. This weakness enables attackers to manipulate database queries through input fields that should only accept legitimate data values. The vulnerability's remote exploitability means that attackers can leverage this flaw from outside the network perimeter without requiring physical access or prior authentication, making it particularly dangerous for web-facing applications.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete system compromise and potential data destruction. An attacker could extract sensitive information including student records, parent details, administrative credentials, and institutional data through unauthorized database queries. The sql injection could also be used to modify or delete critical system data, potentially disrupting the educational institution's operations and violating data protection regulations. Given that this is an administrative function, successful exploitation could provide attackers with elevated privileges to manipulate class enrollments, alter schedules, and compromise the entire enrollment system's integrity.
Security mitigation strategies should focus on implementing proper input validation and parameterized queries to prevent sql injection attacks. The application code must be updated to use prepared statements with bound parameters rather than direct string concatenation in sql queries. Additionally, implementing proper access controls and input sanitization measures for all user-supplied parameters in the edit-class.php file is essential. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other parts of the application. Network segmentation and web application firewalls can provide additional layers of protection, while monitoring systems should be deployed to detect anomalous database access patterns that might indicate exploitation attempts. The vulnerability's public disclosure status necessitates immediate remediation to prevent exploitation by threat actors who may already be targeting this specific weakness. This aligns with ATT&CK technique T1190 which describes the use of remote services to gain initial access and T1071.004 which covers application layer protocol manipulation for command execution.