CVE-2025-6913 in Student Record System
Summary
by MITRE • 06/30/2025
A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This critical vulnerability exists within the PHPGurukul Student Record System version 3.2, specifically targeting the administrative profile functionality. The flaw resides in the /admin-profile.php file where an unsanitized input parameter named aemailid is processed without proper validation or sanitization measures. This SQL injection vulnerability allows attackers to manipulate database queries through malicious input, potentially compromising the entire system's data integrity and confidentiality.
The technical exploitation occurs when an attacker sends crafted payloads through the aemailid parameter in the administrative profile section. This vulnerability falls under CWE-89 which categorizes SQL injection flaws as one of the most severe application security weaknesses. The attack vector is remote, meaning unauthorized users can exploit this weakness without requiring physical access to the system, making it particularly dangerous for web applications that are publicly accessible.
The operational impact of this vulnerability is substantial as it provides attackers with potential access to sensitive student and administrative data stored within the database. Successful exploitation could enable unauthorized data retrieval, modification, or deletion of critical educational records including student personal information, academic performance data, and administrative credentials. The disclosed exploit availability increases the risk profile significantly, as threat actors can readily leverage this weakness without requiring advanced technical skills.
Security mitigations should prioritize immediate patching of the affected PHPGurukul Student Record System to address the SQL injection vulnerability in the admin-profile.php file. Additionally, implementing proper input validation and parameterized queries would prevent malicious SQL code execution. Organizations should also deploy web application firewalls to monitor and filter suspicious database access patterns. Regular security assessments and code reviews are essential to identify similar vulnerabilities in other components of the system. The MITRE ATT&CK framework categorizes this as a database injection technique, specifically targeting credential access and data manipulation phases within attack chains.
Implementation of proper output encoding and least privilege access controls for administrative functions would further reduce the potential impact of exploitation attempts. Database activity monitoring should be enabled to detect anomalous query patterns that might indicate attempted SQL injection attacks. The vulnerability demonstrates the importance of input sanitization practices as outlined in OWASP Top Ten security guidelines, particularly focusing on preventing injection flaws in web applications. Regular updates and security patches for all software components remain crucial defensive measures against known vulnerabilities like this one.