CVE-2025-65379: SQL Injection

Published Dec 2, 2025

Updated

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

Affected Software

2 affected components

Phpgurukul Billing System

Phpgurukul Billing System=1.0

Event History

Dec 2, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-65379?

CVE-2025-65379 is classified as a critical vulnerability due to its potential for SQL Injection attacks.

How do I fix CVE-2025-65379?

To fix CVE-2025-65379, validate and sanitize user inputs for the username and mobileno parameters before using them in SQL queries.

What software is affected by CVE-2025-65379?

CVE-2025-65379 affects PHPGurukul Billing System version 1.0.

What is SQL Injection in the context of CVE-2025-65379?

In the context of CVE-2025-65379, SQL Injection allows an attacker to manipulate SQL queries by exploiting unvalidated user input.

Can CVE-2025-65379 lead to data compromise?

Yes, if exploited, CVE-2025-65379 can lead to unauthorized access or manipulation of the database, compromising sensitive data.