CVE-2025-4907: PHPGurukul Daily Expense Tracker System forgot-password.php sql injection

Published May 19, 2025

Updated

A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

Phpgurukul Daily Expense Tracker System

Phpgurukul Daily Expense Tracker System=1.1

Event History

May 19, 2025

CVE Published

via MITRE·02:31 AM

Data Sourced

via MITRE·02:31 AM

DescriptionSeverityWeakness

Sep 1, 57367

Event

via FIRST·10:29 AM

Frequently Asked Questions

What is the severity of CVE-2025-4907?

CVE-2025-4907 has been rated as a critical vulnerability.

What functionality is affected by CVE-2025-4907?

CVE-2025-4907 affects the functionality of the file /forgot-password.php in PHPGurukul Daily Expense Tracker System 1.1.

What type of vulnerability is CVE-2025-4907?

CVE-2025-4907 is an SQL injection vulnerability caused by improper handling of the email argument.

How can I mitigate CVE-2025-4907?

To mitigate CVE-2025-4907, you should implement proper input validation and use parameterized queries for database access.

What could be the impact of exploiting CVE-2025-4907?

Exploiting CVE-2025-4907 could allow an attacker to execute arbitrary SQL queries on the database.