CVE-2025-2676: High SQL Injection in PHPGurukul Bank Locker

CVE-2025-2676 is a High severity (CVSS 7.3) SQL injection in PHPGurukul Bank Locker Management System 1.0. The sadminusername argument of /add-subadmin.php reaches a database query unsafely. The record names no fixed version, so limit access and have the vendor site checked for a patch.

What's affected

The record lists one affected release: PHPGurukul Bank Locker Management System version 1.0. The weak spot is the file /add-subadmin.php and the sadminusername argument. No other versions are named, and the record gives no patched version.

PHPGurukul sells and distributes small PHP projects, and this one is a web application that tracks lockers, sub administrators and customer records. Because the project ships as source code that people copy into their own web root, there is no central update channel. Whether you are exposed depends on whether you deployed it, not on a package manager entry.

How to check if you're exposed

There is no package to query, so start from the file system and the web logs. First, confirm you run this project and which version:

find /var/www -type f -name "add-subadmin.php" 2>/dev/null

Then look at how sadminusername is used in that file. Any place where the value is joined into a SQL string instead of passed as a bound parameter is the pattern the CVE describes:

grep -n "sadminusername" $(find /var/www -type f -name "add-subadmin.php" 2>/dev/null)

Finally, check your web server access log for unusual requests to /add-subadmin.php, such as very long values, quote characters or SQL keywords in the sadminusername field. Adjust the log path to your server.

grep "add-subadmin.php" /var/log/apache2/access.log | head -50

If you run a scanner that builds a software inventory, the free in-browser dependency scan will not see this one, because it is application code and not a library. That is a case for code level review.

What to do now

1. Find every deployment of PHPGurukul Bank Locker Management System in your estate, including test copies and demo installs that were never cleaned up.
2. Take internet facing copies behind a login, a VPN or an IP allow list until the code is fixed. The CVSS vector shows no privileges are needed, so network exposure is the main risk.
3. Check the vendor site for an updated release. The record does not confirm one, so do not assume version 1.0 has been patched.
4. If you maintain the code, change the query in add-subadmin.php to use prepared statements with bound parameters for sadminusername, and apply the same change to every other query in the project.
5. Run the database account with the fewest rights it needs. It should not own the schema or have file or administrative privileges.
6. Review logs and database content for signs of tampering, and rotate credentials stored in the application database if you find any.

Why it matters

The record classes this under CWE-74 and CWE-89. In plain terms, user input is treated as part of a SQL command instead of as data. When an application builds a query by pasting a request value into a string, anyone who can send that request can change what the query does.

The CVSS vector scores confidentiality, integrity and availability impact as low each, which is why the score sits at 7.3 and not higher. That reflects what one query in one page can reach, but a database behind a locker or care home system usually holds personal records, so low per field does not mean harmless. The record says the exploit has been disclosed to the public, and it does not list this CVE in the CISA KEV catalog.

Several sibling CVEs exist for other pages in the same project family. That pattern suggests the problem is a coding habit across the code base, not one slip. Fixing a single file helps, but a review of every query is the real remedy.

Quick check

Sources

• PHPGurukul vendor site

Last reviewed: 19 October 2026.