SQL Injection Vulnerability in PHPGurukul Men Salon Management System
CVE-2025-3690

9.8CRITICAL

Key Information:

Vendor

PHPGurukul
Status
Men Salon Management System
Vendor
CVE Published:
16 April 2025

What is CVE-2025-3690?

A vulnerability exists in the PHPGurukul Men Salon Management System 1.0 that allows for remote SQL injection through improper handling of parameters in the /admin/edit-services.php file. Malicious actors can manipulate the 'cost' argument, leading to unauthorized database access and potential data compromise. The exploit has been publicly disclosed, raising concerns over its impact on users of the affected system.

References

https://github.com/Xiaoyao-i03i/CVE/issues/2
https://github.com/Xiaoyao-i03i/CVE/issues/2
https://phpgurukul.com/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.