CVE-2025-2381 is a high severity SQL injection (CVSS 7.3) in PHPGurukul Curfew e-Pass Management System 1.0, in the file /admin/search-pass.php through the searchdata argument. The record lists no fixed version. Until the vendor ships one, limit who can reach the app, review logs for abuse, and move the query to parameterized statements.
What's affected
The NVD record names PHPGurukul Curfew e-Pass Management System 1.0. The weak spot is the file /admin/search-pass.php, where the searchdata value reaches a database query without safe handling. The description says the exploit has been disclosed to the public. The record is not on the CISA Known Exploited Vulnerabilities list, so there is no listed evidence of attacks in the wild.
The weaknesses are classed as CWE-74 (injection) and CWE-89 (SQL injection). The score is 7.3 (HIGH). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is limited on confidentiality, limited on integrity and limited on availability. The record was published on 2025-03-17.
The record lists no fixed version, and none of its references is a vendor advisory with a patch, so I cannot name one. Check the PHPGurukul site for a newer release before assuming you must stay on this build. Treat any copy at the listed version as exposed until you know otherwise.
How to check if you're exposed
There is no package to query here. Curfew e-Pass Management System is source code you deploy yourself, so the check is an inventory exercise.
- List where the app is installed. A file name search is the quickest start.
find / -name "search-pass.php" -not -path "*/proc/*" 2>/dev/null
- Read the version from the app or its release notes. Only 1.0 is named in the record, so a different version may or may not be affected. Ask the vendor if you are unsure.
- Note who can reach it. An internet facing copy is the urgent case.
- Look through logs for odd requests to the file, such as long values or SQL words in
searchdata.
grep -i "search-pass.php" /var/log/nginx/access.log | grep -iE "select|union|sleep|%27"
Treat matches as leads to investigate. Also check your database for rows you do not recognise.
What to do now
- Find every copy of Curfew e-Pass Management System 1.0 in your environment, including test and demo installs that people forgot.
- If nobody needs it, take it offline. An unused install is only risk.
- Restrict access with a VPN, an IP allowlist or web server authentication in front of the affected path while you wait for a vendor fix.
- Add a web application firewall rule for SQL keywords in
searchdataas a stopgap. It buys time and does not fix the code. - If you maintain the code, replace string built queries with prepared statements using mysqli or PDO, and run the app with a database account that has only the rights it needs.
- Watch the PHPGurukul site for a release, then upgrade and re-test the affected page.
Why it matters
The root cause is trust in input. The page takes a value from the request and places it straight into a query, so the database runs whatever shape that value gives it. The record files this under CWE-89 and CWE-74. Parameterized queries remove the problem at the source, and input validation helps as a second layer.
The practical risk depends on what the database holds. A pass management system stores applicant names, identity details and pass status, which are personal records. The scoring assumes limited impact on each of confidentiality, integrity and availability, which is typical for this kind of bug, but a real database often holds more than the score suggests. If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Is a fix available for CVE-2025-2381?
The record lists no fixed version and no vendor advisory, so none is confirmed here. Check the PHPGurukul site, and until you find one, restrict access and review logs.
Is this the only parameter at risk?
Not necessarily. Injection bugs usually come from a pattern in the code, not a single line. If one query is built from strings, others in the same app may be as well, so review every place the app talks to the database.
Sources
- Safeguard Gold entry for CVE-2025-2381
- NVD record data for CVE-2025-2381 (published 2025-03-17)
- Reference listed in the record (vendor site)
Last reviewed: 19 October 2026.
