CVE-2025-3239 is a high severity SQL injection flaw (CVSS 7.3) in PHPGurukul Online Fire Reporting System 1.2. It affects /admin/edit-guard-detail.php, where the editid argument reaches a database query unsafely. The record lists no fixed version, so check with the vendor, limit exposure, and rewrite the query with prepared statements.
What's affected
The NVD record names PHPGurukul Online Fire Reporting System version 1.2. The weak spot is the file /admin/edit-guard-detail.php, and the argument the record points to is editid. The two weakness classes are CWE-74 (improper neutralization of special elements in output used by a downstream component) and CWE-89 (SQL injection).
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms, the flaw can be reached over the network, needs little skill to attempt, and the vector shows that no login is required. Each of confidentiality, integrity and availability is rated low, which is why the score is 7.3 and not higher.
The record does not list a fixed version, and it says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy of this software that is reachable from the internet as the priority.
How to check if you're exposed
This is a PHP style web application distributed as source code, so there is usually no package manager entry to query. Check your own deployment instead.
- Find out whether you run it. Search your web roots for the vulnerable file name:
find /var/www -type f -name 'edit-guard-detail.php' 2>/dev/null
- Confirm the version from the project's own files, install notes or the page footer, and compare it with version 1.2 from the record.
- Look at how the editid value is used. A query built by joining strings with request input is the pattern the advisory describes:
grep -n 'mysqli_query\|->query(' admin/edit-guard-detail.php 2>/dev/null
- Review web server access logs for requests to that file with unusual characters in the parameter, and for database errors around the same times.
If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reading the code of a hand-deployed PHP application.
What to do now
- Decide whether this application is needed. If it is a demo or a training project, remove it from any server that holds real data.
- Look for a vendor patch using the NVD references. No fixed version appears in the record, so do not assume one exists.
- Validate and bind the editid input in
/admin/edit-guard-detail.php: use parameterized queries, and reject values that do not match the expected type. - Run the database user with least privilege and turn off verbose database errors in responses.
- Back up the database before changes, then review recent records for tampering.
- Record the application in your inventory so the next advisory is easy to match.
Why it matters
This is a textbook injection bug, the kind that CWE-89 describes. A value that should be plain data, in this case editid, is placed into a query as text. Anything that can reach the page can try to change what the query does, and the record says the attack can be started remotely.
The wider lesson is about inventory. Small PHP applications get installed once, forgotten, and never appear in a dependency list. When a CVE lands, nobody knows they run it. Keeping a simple list of what runs where is what turns a notice like this into a ten minute check.
Quick check
Is there a fixed version of Online Fire Reporting System?
The NVD record does not list one. Check the vendor site and the record's references before you assume a patch exists, and apply the mitigations above in the meantime.
Is this exploited in the wild?
The record says the exploit was disclosed publicly. It is not on the CISA Known Exploited Vulnerabilities list, and nothing reviewed confirms active attacks.
Sources
- Gold entry for CVE-2025-3239
- NVD record for CVE-2025-3239, published 2025-04-04, as summarised above
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
Last reviewed: 19 October 2026.
