SQL Injection Vulnerability in PHPGurukul Notice Board System
CVE-2025-5639

6.9MEDIUM

Key Information:

Vendor: PHPgurukul
Status: Notice Board System
Vendor: CVE Published:; 5 June 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-5639?

A vulnerability exists in the PHPGurukul Notice Board System where improper handling of the email argument in the /forgot-password.php file allows an attacker to inject SQL commands. This issue can be exploited remotely, posing a significant risk to the integrity of the database. The nature of the vulnerability enables unauthorized access or manipulation of sensitive data, highlighting the critical need for immediate remediation and implementation of security best practices.

Affected Version(s)

Notice Board System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-5639 - Proof of Concept

References

https://vuldb.com/?id.311126

vdb-entrytechnical-description

https://vuldb.com/?ctiid.311126

signaturepermissions-required

https://vuldb.com/?submit.589812

third-party-advisory

CVSS V4

Score:

6.9

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction: