CVE-2025-3690 is a High severity (CVSS 7.3) SQL injection in PHPGurukul Men Salon Management System 1.0. The cost parameter of the edit services page is the weak point. The record names no fixed version, so restrict access and parameterise the query.
What's affected
The record names PHPGurukul Men Salon Management System 1.0. The vulnerable code is the file /admin/edit-services.php, through the cost parameter.
The record names no fixed version, and I found no vendor advisory. Treat the product as unpatched until its maker says otherwise.
How to check if you're exposed
Start by finding out whether you run the product. Check web server document roots, container images and old project folders for it, and look at the version in the admin area or the installed files.
If you do run it, review web server and database logs for unusual requests to that page, especially ones containing quote characters, SQL keywords or very long values in the parameter. Unexpected database errors in the application log are another sign. Do not test the flaw against a system you do not own.
What to do now
- Locate every copy of the application, including test and demo installs.
- Take it off the internet or put it behind a VPN or an IP allow list until it is fixed.
- Ask the vendor or project for a fix, and watch the advisory sources for one.
- If you can change the code, switch the query to a parameterised statement and validate the value as the type it should be.
- Use a database account with only the access the application needs, so a flaw cannot reach other data.
- Back up the database, and review it and your logs for signs of tampering.
Why it matters
The weakness is CWE-74 (Injection), CWE-89 (SQL Injection). The application builds a database query by joining text that comes from the request into the SQL statement. Because the database cannot tell the developer's SQL from the attacker's text, crafted input changes what the query does. The usual impact is reading or changing data in the database, and sometimes more.
The vector is network, low complexity, no privileges and no interaction, with low impact on each of confidentiality, integrity and availability, giving 7.3.
This is the second SQL injection reported in this product on the same day, after CVE-2025-3689 in the edit customer page. A numeric field such as cost is a classic place to miss validation, because developers assume the value is a number. Check that every numeric value is converted to a number before it is used, and that every query is parameterised. The record says the exploit has been disclosed to the public.
Quick check
Why is a cost field vulnerable?
Numeric fields are often added to a query without checking that they are numbers. Parameterised queries and type checks remove that risk.
Is it the same as CVE-2025-3689?
No. It is a separate flaw in a different page of the same product.
Sources
Last reviewed: 18 October 2026.
