CVE-2025-3242 is a medium severity SQL injection flaw (CVSS 6.3) in PHPGurukul e-Diary Management System 1.0. It affects /search-result.php, where the id and searchdata argument reaches a database query unsafely. The record lists no fixed version, so check with the vendor, limit exposure, and rewrite the query with prepared statements.
What's affected
The NVD record names PHPGurukul e-Diary Management System version 1.0. The weak spot is the file /search-result.php, and the argument the record points to is id and searchdata. The two weakness classes are CWE-74 (improper neutralization of special elements in output used by a downstream component) and CWE-89 (SQL injection).
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms, the flaw can be reached over the network, needs little skill to attempt, and the vector shows that a low privilege account is required. Each of confidentiality, integrity and availability is rated low, which is why the score is 6.3 and not higher.
The record does not list a fixed version, and it says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy of this software that is reachable from the internet as the priority.
How to check if you're exposed
This is a PHP style web application distributed as source code, so there is usually no package manager entry to query. Check your own deployment instead.
- Find out whether you run it. Search your web roots for the vulnerable file name:
find /var/www -type f -name 'search-result.php' 2>/dev/null
- Confirm the version from the project's own files, install notes or the page footer, and compare it with version 1.0 from the record.
- Look at how the id and searchdata value is used. A query built by joining strings with request input is the pattern the advisory describes:
grep -n 'mysqli_query\|->query(' search-result.php 2>/dev/null
- Review web server access logs for requests to that file with unusual characters in the parameter, and for database errors around the same times.
If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reading the code of a hand-deployed PHP application.
What to do now
- Take the application off the public internet if it does not need to be there. Put it behind a VPN or an allow list.
- Check the vendor site and the references in the NVD record for a patch. The record does not give a fixed version, so the vendor advisory should be checked directly.
- Change the query behind
/search-result.phpto use prepared statements with bound parameters, so the id and searchdata value is always treated as data. - Make sure the database account used by the application can only touch the tables it needs, with no administrative rights.
- Add a web application firewall rule as a stopgap, and keep logging so you can see attempts.
- Check the database for rows you do not recognise, and rotate any credentials the application stores.
Why it matters
SQL injection happens when a program builds a database command by joining text with input from a request. If the input is not kept separate from the command, the database can treat part of it as instructions. Here the record names the id and searchdata argument of /search-result.php as the place where that happens.
The consequence depends on what the database holds. For an application of this type, that can be personal or operational records, and a low rating on each of confidentiality, integrity and availability still means data could be read, changed or disrupted. The fix is old and well understood: keep data and commands apart with prepared statements.
Quick check
Is there a fixed version of e-Diary Management System?
The NVD record does not list one. Check the vendor site and the record's references before you assume a patch exists, and apply the mitigations above in the meantime.
Is this exploited in the wild?
The record says the exploit was disclosed publicly. It is not on the CISA Known Exploited Vulnerabilities list, and nothing reviewed confirms active attacks.
Sources
- Gold entry for CVE-2025-3242
- NVD record for CVE-2025-3242, published 2025-04-04, as summarised above
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
Last reviewed: 19 October 2026.
