CVE-2025-2644 is a High severity SQL injection flaw (CVSS 7.3) in PHPGurukul Art Gallery Management System 1.0. The arttype value is passed unsafely to the database through /admin/add-art-product.php. No fixed version is named in the record, so treat the product as unpatched and fix the query yourself or take it offline.
What's affected
- Product: PHPGurukul Art Gallery Management System
- Version: 1.0 (the only version named in the record)
- Location: /admin/add-art-product.php
- Parameter: arttype
- Fixed version: none named in the record
The record describes the affected code as an admin page that adds art products. This is the second report against the same application in the same batch of disclosures, and it uses the same parameter name as CVE-2025-2643 on a different page. That pattern is a hint that the application builds queries the same way in many places, so fixing one file is not enough.
The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is being exploited in attacks, and the CISA Known Exploited Vulnerabilities catalog does not list it. Public disclosure still matters, because it lowers the effort for anyone who wants to try.
How to check if you're exposed
Start by finding out whether you run this product at all. Small PHP applications are often copied onto a server by hand, so there may be no package manager entry to query.
# find copies of the affected file on a web server
find /var/www -type f -path "*/admin/add-art-product.php" 2>/dev/null
# see how the parameter is used in that file
grep -n "arttype" /path/to/the/file.php
# look for queries built by joining strings
grep -rn "mysqli_query\|->query(" --include=*.php /path/to/app
In the results, look for a request value (from the GET or POST arrays) that lands inside a SQL string without being bound as a parameter. If you see that, treat the page as vulnerable, whatever its version label says.
Also check your web server logs for odd values in the arttype parameter, such as long strings or quote characters. Do not run any test against a system you do not own or have permission to test.
What to do now
- Find every deployment of Art Gallery Management System 1.0 and decide whether it needs to be reachable from the internet. If not, restrict it to a VPN or an allow list today.
- Check the vendor site at phpgurukul.com or the original download page for a newer release, and read its notes. The record does not name one, so do not assume a fix exists.
- Change the query in /admin/add-art-product.php to a prepared statement, as shown below, and review every other file that builds SQL from request values.
- Give the database account the application uses only the permissions it needs, so a flaw in one page cannot reach every table.
- Rotate any passwords stored in the database if you cannot rule out that the flaw was used against you, and review logs for the period since 2025-03-23, when the issue was published.
// bind the value instead of joining it into the SQL string
$stmt = $con->prepare("SELECT id, name FROM items WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
Binding keeps data and SQL apart. A value that contains quote characters then stays a value, whatever it contains.
Why it matters
The weakness is CWE-89 (SQL injection). Here is the plain version: the application builds a database command by gluing text from the request into it, and the database cannot tell which part the developer wrote and which part a visitor typed. The record also lists CWE-74 (injection), the broader injection class that SQL injection falls under.
The score of 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a network reachable flaw that needs no special conditions, with limited impact on each of confidentiality, integrity and availability. That is a modest score on paper. In practice the damage depends on what is in the database, and for applications that store personal data, a limited score can still mean a real incident. Scanners can find this class of bug in source code, which is why a static check on pull requests catches most of it before release.
Quick check
Is there a patch for CVE-2025-2644?
The record names only version 1.0 as affected and gives no fixed version. I could not confirm a patch, so check the vendor page and treat the product as unpatched until you find one.
Is CVE-2025-2644 being exploited in the wild?
The record says a public exploit exists, but CVE-2025-2644 is not in the CISA Known Exploited Vulnerabilities catalog. Public disclosure means you should act soon, not that attacks have been confirmed.
Sources
Scan your own dependencies and app code for flaws like this with the free in-browser scan.
Last reviewed: 19 October 2026.
