PHPGurukul Online Marriage Registration System 1.0 has a high severity SQL injection, tracked as CVE-2025-4927 (CVSS 7.3). The weak spot is /admin/between-dates-application-report.php and the input fromdate and todate. The record names no patched release, so lock down access and fix the query handling yourself.
What's affected
The record lists PHPGurukul Online Marriage Registration System version 1.0. The vulnerable file is /admin/between-dates-application-report.php, and the input is fromdate and todate. A date range report builds a query from two values the user supplies, and this one sits in the admin area of a system that holds personal records.
The CVE record does not give a patched version, and I found no vendor patch in the pages I could read. Check the vendor site and the public report listed under Sources before you assume a fix exists. If you run a fork or a copy that someone adapted for internal use, assume it carries the same flaw until you have read the code.
How to check if you're exposed
Start with inventory. This kind of software is often downloaded as a source code sample, adapted, and left running on a shared host, so nobody remembers it is there. Search your web roots for the file named in the record. Adjust the path to your server layout.
find /var/www -name "between-dates-application-report.php" -type f 2>/dev/null
Then read how the file builds its query. A string joined together with the request value is the warning sign. A prepared statement with bound parameters is the safe form.
grep -n "fromdate" /var/www/html/admin/between-dates-application-report.php
grep -nE "mysqli_query|->query\(" /var/www/html/admin/between-dates-application-report.php
Finally look at your access logs for requests to /admin/between-dates-application-report.php. Unusually long values, or values full of quote characters, in the fromdate and todate input deserve a closer look. A web application scan can confirm from the outside whether the page is reachable and what it runs.
What to do now
- Find every copy of PHPGurukul Online Marriage Registration System in your environment, including test and demo installs.
- Take it off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Replace string built queries in /admin/between-dates-application-report.php with prepared statements and bound parameters, and review the other pages of the application for the same pattern.
- Run the application's database account with the fewest rights it needs, and never with administrator rights over the whole server.
- Remove real personal or business data from any copy that does not need it, and rotate passwords stored in the database if you see signs of abuse.
- Watch the vendor site and the public issue for a release, and plan to move to a maintained application if none appears.
Why it matters
The weakness is SQL injection, filed as CWE-89 and the broader injection class CWE-74. Nothing about this class of bug is new. When a value from a request is pasted into a query string, the database cannot tell the developer's intent from the visitor's input.
The record gives the score as 7.3 with a network attack vector and low complexity. The vector rates impact as low for confidentiality, low for integrity and low for availability. A database sits behind the page, and the real outcome depends on what that database holds and what rights the application account has. This CVE is not on the CISA Known Exploited Vulnerabilities list, and neither the record nor the pages I read report exploitation in the wild. The record does say the exploit has been disclosed to the public, which is enough reason to act before someone tries it against you.
Quick check
Does the CVSS vector say I need an account?
The vector lists no privileges required. The record also says the attack can start remotely. Read it as exposed to anyone who can reach the application, and confirm against your own copy of the code.
Is there a patch I can install?
The CVE record does not name a fixed version, and I could not confirm a vendor release. Check the vendor site and the public issue linked below. If nothing is available, fix the query yourself with prepared statements and keep the application off the open internet.
Sources
Last reviewed: 18 October 2026.
