CVE-2025-4151 is a high severity SQL injection (CVSS 7.3) in PHPGurukul Curfew e-Pass Management System 1.0. The fromdate argument of /admin/pass-bwdates-reports-details.php reaches the database unsafely, and the record says the exploit has been disclosed to the public. I could not confirm a fixed version, so restrict access.
What's affected
The CVE record names PHPGurukul Curfew e-Pass Management System 1.0. The affected file is /admin/pass-bwdates-reports-details.php, and the argument is fromdate. The record says the attack can be launched remotely.
The record states that the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
I found no vendor advisory or fixed version in the record. The references are a public write-up on GitHub, VulDB entries and the PHPGurukul home page, so check the vendor site for a newer release.
The record adds that other parameters might be affected as well, so a fix for one argument is not proof that the whole page is clean.
How to check if you're exposed
Confirm that you run Curfew e-Pass Management System and which version. The record names 1.0, so treat that and anything older as affected. If the code was downloaded and modified locally, compare it with the path named above.
Next, look at the exposure. The vector says no privileges are needed, even though the path sits under the admin area in some of these apps, so do not rely on a login page as protection. Check your web server logs for requests to /admin/pass-bwdates-reports-details.php with strange values in fromdate, or with a burst of server errors.
If you run several PHPGurukul projects, check each one. They are sample style PHP applications that often share patterns, so one bug is often a sign of others.
What to do now
- Find every copy of Curfew e-Pass Management System you run, including demo and training servers.
- Check phpgurukul.com for an updated release, and read its notes before installing.
- Restrict /admin/pass-bwdates-reports-details.php to trusted addresses with web server rules, or take the application offline if you do not need it.
- If you maintain the code, switch the database calls to parameterized queries and validate the input type.
- Use a database account with the minimum rights, and take a verified backup before any change.
Why it matters
The record lists CWE-74, injection, and CWE-89, SQL injection. The page takes a value from the request, here fromdate, and places it in a database query. If the value is not handled as plain data, the sender can alter the query, which can expose or change the stored records.
The CVSS vector scores the impact as low across confidentiality, integrity and availability, which is why the score is 7.3 and not higher. Those apps may still hold personal records, so a low score on paper is not a reason to wait.
The standard fix is a parameterized query. It keeps the command and the data separate, so a date field can only ever be a date.
Quick check
Is there a patch for CVE-2025-4151?
I could not confirm one. The record cites no vendor advisory, so check the PHPGurukul site for your project.
Why is the score high if the impact is low?
The vector is network reachable, low complexity and needs no privileges or user interaction. Easy access raises the score even when each impact is rated low.
Sources
Last reviewed: 18 October 2026.
