CVE-2025-2472: High SQL Injection in PHPGurukul Apartment Visitors Login

CVE-2025-2472 is a high severity SQL injection (CVSS 7.3) in PHPGurukul Apartment Visitors Management System 1.0, in the file /index.php through the username argument. The record lists no fixed version. Until the vendor ships one, limit who can reach the app, review logs for abuse, and move the query to parameterized statements.

What's affected

The NVD record names PHPGurukul Apartment Visitors Management System 1.0. The weak spot is the file /index.php of the Sign In component, where the username value reaches a database query without safe handling. The description says the exploit has been disclosed to the public. The record is not on the CISA Known Exploited Vulnerabilities list, so there is no listed evidence of attacks in the wild.

The weaknesses are classed as CWE-74 (injection) and CWE-89 (SQL injection). The score is 7.3 (HIGH). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is limited on confidentiality, limited on integrity and limited on availability. The record was published on 2025-03-18.

The record lists no fixed version, and none of its references is a vendor advisory with a patch, so I cannot name one. Check the PHPGurukul site for a newer release before assuming you must stay on this build. Treat any copy at the listed version as exposed until you know otherwise.

How to check if you're exposed

There is no package to query here. Apartment Visitors Management System is source code you deploy yourself, so the check is an inventory exercise.

1. List where the app is installed. A file name search is the quickest start.

find / -name "index.php" -not -path "*/proc/*" 2>/dev/null

2. Read the version from the app or its release notes. Only 1.0 is named in the record, so a different version may or may not be affected. Ask the vendor if you are unsure.
3. Note who can reach it. An internet facing copy is the urgent case.
4. Look through logs for odd requests to the file, such as long values or SQL words in username.

grep -i "index.php" /var/log/nginx/access.log | grep -iE "select|union|sleep|%27"

Treat matches as leads to investigate. Also check your database for rows you do not recognise.

What to do now

1. Find every copy of Apartment Visitors Management System 1.0 in your environment, including test and demo installs that people forgot.
2. If nobody needs it, take it offline. An unused install is only risk.
3. Restrict access with a VPN, an IP allowlist or web server authentication in front of the affected path while you wait for a vendor fix.
4. Add a web application firewall rule for SQL keywords in username as a stopgap. It buys time and does not fix the code.
5. If you maintain the code, replace string built queries with prepared statements using mysqli or PDO, and run the app with a database account that has only the rights it needs.
6. Watch the PHPGurukul site for a release, then upgrade and re-test the affected page.

Why it matters

This is classic injection: user supplied text is concatenated into a SQL statement. The record maps it to CWE-89 and CWE-74. The defence is the same everywhere, which is to keep data and query structure apart with prepared statements and to give the app a database user with narrow rights.

Public disclosure of the exploit lowers the effort needed to try it against an exposed server. The weak spot is on the sign in page, which sits in front of visitor logs and administrator accounts. Reducing exposure now is cheaper than cleaning up later. If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-2472
• NVD record data for CVE-2025-2472 (published 2025-03-18)
• Reference listed in the record (vendor site)

Last reviewed: 19 October 2026.