CVE-2025-2738: High SQL Injection in PHPGurukul Old Age Home

CVE-2025-2738 is a high severity (CVSS 7.3) SQL injection flaw in PHPGurukul Old Age Home Management System. The namesc argument of /admin/manage-scdetails.php is passed into a database query unsafely. The record names no fixed release, so limit exposure of the admin area, apply a code-level fix if you maintain the app, and watch the vendor.

What's affected

The record lists PHPGurukul Old Age Home Management System 1.0 as affected. The product is a small web application used to manage a care home.

The NVD description says the flaw sits in /admin/manage-scdetails.php and that the namesc argument is the injection point. It says the attack can be started remotely and that the exploit has been disclosed to the public. The record does not name a patch.

Severity in the record: high, CVSS 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Weakness classes: CWE-74 (Injection), CWE-89 (SQL injection).

How to check if you're exposed

There is no package version to query, so exposure is a question of whether you run this application at all.

1. Search your asset inventory, hosting accounts and internal wiki for PHPGurukul Old Age Home Management System.
2. If you find an install, look for the file /admin/manage-scdetails.php in the web root. Its presence on a reachable server means you run the affected code path.
3. Check your web server access logs for requests to that file from addresses you do not recognise, and for unusually long or odd parameter values.
4. Confirm whether the application is reachable from the internet or only from an internal network.

You can also run a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries your own applications pull in, though a standalone application like this one is usually found by asset inventory rather than by a package manifest.

What to do now

1. Decide whether PHPGurukul Old Age Home Management System still needs to run. Small standalone projects like this are often installed once and forgotten, and removing one you no longer use is the cleanest fix.
2. Take the admin area off the public internet. Put it behind a VPN, an IP allow list or HTTP authentication at the web server.
3. If you maintain the code, change the query behind namesc to use prepared statements with bound parameters, and validate the value as the type the page expects.
4. Run the application database account with the least privilege it needs, so a successful injection cannot read or change unrelated tables.
5. Add a web application firewall rule or request filter as a stopgap, and log blocked attempts.
6. Check the vendor or project page and the references below for a fixed release, and update as soon as one is named.

Why it matters

SQL injection (CWE-89) happens when user input is placed into a query string instead of being passed as a bound parameter. The database cannot tell where the developer's query ends and the attacker's input begins, so crafted input can change what the query does. The related class CWE-74 covers injection in general: data from outside is treated as part of a command.

The scoring here is moderate rather than extreme because the vector shows low impact on confidentiality, integrity and availability, but it needs no login and no user interaction. For a small application that holds personal or business records, even low impact on each axis adds up. Public disclosure of the issue also means scanners can look for it.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• https://github.com/X-X-007/cve/issues/2
• https://vuldb.com/?id.300760
• https://phpgurukul.com/
• Safeguard Gold entry for CVE-2025-2738

Last reviewed: 19 October 2026.