CVE-2025-25349: Critical SQL Injection in PHPGurukul Expense Tracker

CVE-2025-25349 is a critical severity (CVSS 9.8) SQL injection flaw in PHPGurukul Daily Expense Tracker System 1.1. The costitem input handled by /dets/add-expense.php reaches a database query unsafely. The record lists no patched release, so fix the query code, restrict access to the app, or retire it.

What's affected

• Product: PHPGurukul Daily Expense Tracker System, a PHP or web application of the kind often downloaded as a learning project or small business tool.
• Affected: version 1.1, as named in the record.
• Fixed: the record names no fixed release. Check the vendor's site before assuming one exists.
• Entry point: /dets/add-expense.php, through the costitem input.
• Access: no login is needed. The attack is network based and needs no user interaction.
• Public exploit information: the researcher's writeup is linked from the record. We did not retrieve details beyond the record.

How to check if you're exposed

Start by finding out whether you run this application at all. Look at your web roots and application inventory for the product name, and check which version the install reports.

Then look at the code. Search for the file and the input named in the record.

grep -rn "costitem" --include=*.php <path-to-app> | head -20

Read the query that handles the value. If the code builds the SQL string by joining the request value into it, the flaw is present. Prepared statements with bound values are the safe pattern.

Check the web server logs for requests to the affected page.

grep "add-expense.php" /var/log/nginx/access.log | less

Look for long or odd looking values, repeated requests from one address, and requests outside business hours. Then compare the database for rows you did not add, rows that have gone missing, or accounts you do not recognise.

What to do now

1. Check whether the application is needed. If not, remove it, because an unpatched app with a public exploit write up has no good reason to stay online.
2. If you need it, change the query code at the affected file so the value is bound as a parameter rather than joined into the SQL string.
3. Restrict access with authentication at the web server, an allow list of addresses or a VPN until the code is fixed.
4. Run the database account the app uses with the least privileges it needs, so a query flaw cannot drop tables or reach unrelated data.
5. Back up the database, then review it for unexpected rows, changed values and new accounts.
6. Rotate any credentials stored in the app's configuration if you saw suspicious requests.
7. Check the vendor or project page regularly for a fixed release.

Why it matters

The class is SQL injection. A value from the request is joined into a database query as text, so the database cannot distinguish the developer's query from the caller's input. The input here is costitem, handled by /dets/add-expense.php.

• CWE-89 is improper neutralization of special elements in an SQL command. Input that should be treated as data ends up inside the query text, so the database cannot tell the application's query from the caller's input.

The record tags CWE-89 alone. The standard fix is the same for every case of this class: use parameterised queries, validate input to the shape you expect, and give the database account only the rights the page needs.

The expense entry form is a typical path for this flaw. Any form that saves a text field to the database must treat the field as data from the start. If other fields in the same form are joined into the same query, check them as well. A sibling record, CVE-2025-25351, covers the dateexpense parameter of the same file.

// Generic pattern: bind the value instead of building the query string
$stmt = $con->prepare("SELECT * FROM some_table WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

Tutorial style PHP projects are a common source of this pattern. They are meant to teach, not to defend, and teams sometimes deploy them as they are. If you use one in production, treat it as code you now maintain, and review every place where a request value reaches a query.

Try it yourself

A code scan finds string built queries like this one early. This demo shows what static analysis flags in a typical PHP project.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Writeup listed in the CVE record

Last reviewed: 19 October 2026.