CVE-2025-6911 in Student Record System
Summary
by MITRE • 06/30/2025
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This critical vulnerability in PHPGurukul Student Record System version 3.2 represents a severe SQL injection flaw that compromises the integrity and confidentiality of educational database systems. The vulnerability manifests specifically within the /manage-subjects.php file where the del argument parameter is improperly handled, allowing attackers to inject malicious SQL code directly into the database query execution flow. This type of vulnerability falls under CWE-89 which categorizes improper neutralization of special elements used in an SQL command, making it a fundamental weakness in database interaction security.
The remote exploitability of this vulnerability presents significant operational risks as attackers can initiate attacks from external networks without requiring physical access to the system. The disclosure of exploit details to the public community accelerates the likelihood of widespread exploitation across vulnerable instances of the Student Record System. This scenario aligns with ATT&CK technique T1190 which describes exploiting vulnerabilities in remote services, and specifically targets the database layer through SQL injection attacks that can lead to complete system compromise.
The technical implementation of this flaw demonstrates poor input validation and sanitization practices within the application's backend processing. When the del parameter is passed to the SQL query without proper escaping or parameterization, malicious actors can manipulate the query structure to extract sensitive data, modify database records, or potentially execute administrative commands on the underlying database system. This vulnerability could enable attackers to access student information, grades, personal details, and other confidential academic records stored within the system's database.
Organizations utilizing this software must implement immediate mitigations including input validation, parameterized queries, and web application firewall protections to prevent exploitation attempts. The remediation should involve proper sanitization of all user inputs, particularly those used in database operations, and implementation of principle of least privilege for database connections. Additionally, regular security audits and penetration testing should be conducted to identify similar vulnerabilities across the entire application stack, as this flaw may indicate broader security weaknesses in the system's architecture that could expose other components to similar attack vectors.