CVE-2025-4861 is a high severity SQL injection (CVSS 7.3) in PHPGurukul Beauty Parlour Management System 1.1. The contactnumber parameter of /admin/admin-profile.php reaches a database query unsafely. The record names no fixed version, so restrict access, fix the query code or retire the application.
What's affected
The record lists PHPGurukul Beauty Parlour Management System 1.1. The weak spot is the admin profile page, in the file /admin/admin-profile.php. The record also says other parameters might be affected, so do not assume one parameter is the whole story.
No fixed version is named in the record or in the report. Check the PHPGurukul site at https://phpgurukul.com/ for an updated package. If you downloaded Beauty Parlour Management System as a source code package, you own the patching, because nothing will update it for you.
The public report linked from the record could not be retrieved when this post was reviewed, so the description here rests on the CVE record alone.
How to check if you're exposed
Start with inventory. Find out whether this application is installed anywhere, including old test servers and forgotten hosting accounts:
find /var/www -type f -path "*/admin/admin-profile.php" 2>/dev/null
Then look at how the parameter is used in the file. A query built by joining strings is the thing to look for:
grep -n "contactnumber" /var/www/html/admin/admin-profile.php
If the value is placed straight into a query string, you are exposed. Next, check who can reach the file. The path sits under an admin folder, but the CVSS vector in the record shows no privileges required, so do not rely on a login screen until you have tested it yourself on a copy.
Finally, read your access logs for requests to this file from addresses you do not know:
grep "/admin/admin-profile.php" /var/log/apache2/access.log | tail -n 50
Adjust the log path for your server. Repeated requests with odd values, or database errors in the application log, are worth escalating.
What to do now
- Confirm whether Beauty Parlour Management System 1.1 runs anywhere in your estate, and who owns it.
- Check the vendor site for a fixed release. If none exists, plan to replace the application or fix the code yourself.
- Until then, put an IP allow list or HTTP basic authentication in front of the whole application, or take it offline if it is not needed.
- Change the vulnerable query to use prepared statements with bound parameters. Cast numeric identifiers to integers before use, and review the other scripts in the same folder for the same pattern.
- Give the database account the least privilege it needs, and rotate the admin and database passwords if the logs show suspicious activity.
Why it matters
The weakness is SQL injection, tracked as CWE-89 and the broader injection class CWE-74. The application builds a database query using text that a user controls, and the database cannot tell the difference between the intended query and the extra instructions. Depending on the account the application uses, that can expose records, change data or break the app.
The record says the exploit has been disclosed to the public and may be used, which means the barrier to abuse is low. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalogue, so there is no confirmed mass exploitation to point to, but you should still treat it as urgent for anything on the internet.
Small PHP projects like this are a common source of the same bug repeated across many files. Fixing one parameter and leaving the rest is a poor trade. A dependency scan will not see this class of problem, because the flaw is in the application's own code, which is why a code scan or a web scan of a staging copy is the right tool.
Quick check
Is there a patch for Beauty Parlour Management System?
The record names no fixed version. Check the vendor site at https://phpgurukul.com/ and plan to replace or fix the code if nothing is available.
Does the admin folder make /admin/admin-profile.php safe?
Not on its own. The CVSS vector in the record shows no privileges required, so confirm on a test copy and add network level restrictions.
Sources
Last reviewed: 18 October 2026.
