CVE-2025-4908: PHPGurukul Daily Expense Tracker System expense-datewise-reports-detailed.php sql injection

Published May 19, 2025

Updated

A vulnerability classified as critical has been found in PHPGurukul Daily Expense Tracker System 1.1. This affects an unknown part of the file /expense-datewise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

Phpgurukul Daily Expense Tracker System

Phpgurukul Daily Expense Tracker System=1.1

Event History

May 19, 2025

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

DescriptionSeverityWeakness

Sep 1, 57367

Event

via FIRST·10:30 AM

Frequently Asked Questions

What is the severity of CVE-2025-4908?

CVE-2025-4908 is classified as a critical vulnerability.

How does CVE-2025-4908 affect the Daily Expense Tracker System?

CVE-2025-4908 affects the /expense-datewise-reports-detailed.php file, leading to SQL injection vulnerabilities.

What is the cause of the vulnerability in CVE-2025-4908?

The vulnerability is caused by improper handling of user input parameters 'fromdate' and 'todate'.

Can CVE-2025-4908 be exploited remotely?

Yes, CVE-2025-4908 can be exploited remotely, allowing an attacker to execute SQL commands on the server.

How do I fix CVE-2025-4908?

To fix CVE-2025-4908, ensure proper input validation and use prepared statements to mitigate SQL injection risks.