CVE-2025-3689 is a High severity (CVSS 7.3) SQL injection in PHPGurukul Men Salon Management System 1.0. The editid parameter of the edit customer page is the weak point. The record names no fixed version, so restrict access and parameterise the query.
What's affected
The record names PHPGurukul Men Salon Management System 1.0. The vulnerable code is the file /admin/edit-customer-detailed.php, through the editid parameter.
The record names no fixed version, and I found no vendor advisory. Treat the product as unpatched until its maker says otherwise.
How to check if you're exposed
Start by finding out whether you run the product. Check web server document roots, container images and old project folders for it, and look at the version in the admin area or the installed files.
If you do run it, review web server and database logs for unusual requests to that page, especially ones containing quote characters, SQL keywords or very long values in the parameter. Unexpected database errors in the application log are another sign. Do not test the flaw against a system you do not own.
What to do now
- Locate every copy of the application, including test and demo installs.
- Take it off the internet or put it behind a VPN or an IP allow list until it is fixed.
- Ask the vendor or project for a fix, and watch the advisory sources for one.
- If you can change the code, switch the query to a parameterised statement and validate the value as the type it should be.
- Use a database account with only the access the application needs, so a flaw cannot reach other data.
- Back up the database, and review it and your logs for signs of tampering.
Why it matters
The weakness is CWE-74 (Injection), CWE-89 (SQL Injection). The application builds a database query by joining text that comes from the request into the SQL statement. Because the database cannot tell the developer's SQL from the attacker's text, crafted input changes what the query does. The usual impact is reading or changing data in the database, and sometimes more.
The vector is network, low complexity, no privileges and no interaction, with low impact on each of confidentiality, integrity and availability, giving 7.3. The path sits under the admin folder, but the vector shows no privileges required, so do not rely on the folder name as a control.
If you run it, a customer database with names and contact details is the likely target. The record says the exploit is public. The same product has a second SQL injection, CVE-2025-3690, in a different page, which suggests the code needs a broader review.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the admin path protected?
The vector in the record requires no privileges, so do not assume the admin folder keeps outsiders away.
Is there a related CVE?
Yes. CVE-2025-3690 is another SQL injection in the same product, in the edit services page.
Sources
Last reviewed: 18 October 2026.
