CVE-2025-4925: PHPGurukul Daily Expense Tracker System expense-monthwise-reports-detailed.php sql injection

Published May 19, 2025

Updated

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

Phpgurukul Daily Expense Tracker System

Phpgurukul Daily Expense Tracker System=1.1

Event History

May 19, 2025

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionSeverityWeakness

Sep 1, 57367

Event

via FIRST·10:29 AM

Frequently Asked Questions

What is the severity of CVE-2025-4925?

CVE-2025-4925 is classified as a critical severity vulnerability.

How does CVE-2025-4925 exploit occur?

CVE-2025-4925 exploits a vulnerability in the /expense-monthwise-reports-detailed.php file through SQL injection in the fromdate/todate arguments.

What systems are affected by CVE-2025-4925?

CVE-2025-4925 affects the PHPGurukul Daily Expense Tracker System version 1.1.

How can users mitigate CVE-2025-4925?

To mitigate CVE-2025-4925, validate and sanitize all user inputs to prevent SQL injection attacks.

What actions should be taken if CVE-2025-4925 is detected?

If CVE-2025-4925 is detected, immediately patch the system and review application code for further vulnerabilities.