CVE-2025-4553: High SQL Injection in PHPGurukul Apartment Visitors 1.0

CVE-2025-4553 is a high severity SQL injection flaw (CVSS 7.3) in PHPGurukul Apartment Visitors Management System 1.0. It sits in /admin/bwdates-reports-details.php and is reached through the fromdate and todate arguments. The record names no fixed release, so keep the application off public networks, restrict its admin path, and check the vendor site for a patch.

What's affected

The NVD record lists one affected product and version: PHPGurukul Apartment Visitors Management System 1.0. The weak spot is the file /admin/bwdates-reports-details.php, where the value of the fromdate and todate arguments reaches a database query without proper handling. The record says the attack can be started remotely and that an exploit has been disclosed to the public.

The record does not list a fixed version. That is common for small PHP projects that publish downloadable source rather than versioned packages. Treat every installation of this release as exposed until the vendor says otherwise, and do not assume that a newer download on the vendor site contains a fix unless its notes say so.

How to check if you're exposed

There is no package manager query for this one, because the application is distributed as PHP source. Work through these checks instead:

• Find every place the application is installed, including test servers and old shared hosting accounts that people forgot about.
• Open the application folder and confirm the product name and version in the project files or the admin page footer.
• Check your web server logs for requests to /admin/bwdates-reports-details.php and look for unusual values in the fromdate and todate arguments, such as quotes, SQL keywords or very long strings.
• Check whether /admin/bwdates-reports-details.php can be reached from the internet without a login or a network restriction.

If the application is a dependency inside a larger codebase, the free in-browser dependency scan will not see source files copied by hand. A manual inventory is the reliable route here.

What to do now

1. List every installation of PHPGurukul Apartment Visitors Management System 1.0 and note which ones face the internet.
2. Restrict the /admin/ path of each installation to trusted IP addresses or a VPN, or take the installation offline if you do not need it.
3. Put a web application firewall rule or reverse proxy filter in front of /admin/bwdates-reports-details.php while you wait for a fix, and review it after any vendor release.
4. Check the PHPGurukul site and the issue linked in the record for a patched release, and read its notes before you upgrade.
5. Rotate database credentials and admin passwords if your logs show suspicious requests to the affected file.
6. If you maintain a copy of the source, change the query to use parameterised statements with bound values instead of string concatenation.

Why it matters

The record lists CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)), CWE-89 (SQL Injection). In plain terms, the application builds a database query using text supplied by the visitor. If that text is not separated from the query structure, the visitor can change what the query does.

The CVSS vector (AV:N, AC:L, PR:N, UI:N) says the flaw can be reached over the network, with low complexity, no privileges and no user interaction. Impact on confidentiality, integrity and availability is rated low. Admin paths are often assumed to be protected by a login, so check whether yours really is, since the vector assumes no authentication is needed. The record does not mark this CVE as exploited in the wild, and CISA does not list it as a Known Exploited Vulnerability.

Quick check

Sources

• NVD record for CVE-2025-4553
• Reporter issue listed in the record
• VulDB entry listed in the record
• PHPGurukul

Last reviewed: 18 October 2026.