CVE-2025-5216 is a high severity SQL injection (CVSS 7.3) in PHPGurukul Student Record System 3.20. The ID parameter handled by /login.php is not safely handled in a database query. The record lists no fixed version, so treat the software as unpatched and review exposure and code.
What's affected
The CVE record names PHPGurukul Student Record System 3.20. The weak spot is the file /login.php, where the ID parameter reaches a database query. The weakness is classed as CWE-89 (SQL injection) and CWE-74 (injection in general).
The record describes the attack as remote and says an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges, no user interaction, and low impact on confidentiality, integrity and availability.
No fixed release is listed in the record. Check the vendor site, the project download page and the VulDB entry for any later version before you decide how to proceed.
How to check if you're exposed
Start with inventory. Find every copy of Student Record System you run, including test and staging copies, and note the version. The record only names 3.20, so a different version is not proven safe, only unreported.
On the server, look at how the file builds its query. From the application root:
grep -n "ID" ./login.php
grep -n "mysqli_query\|->query(" ./login.php
If you see the request value joined into a SQL string, the code is the kind the record describes. Code that uses prepared statements with bound values does not have this weakness.
Then check reachability. From a machine outside your network, confirm whether the path /login.php answers at all. Review web server access logs for requests to that path that contain quote characters, SQL keywords or very long values, and review database logs for errors or odd queries around the same times.
If the app has a Composer file, the free in-browser dependency scan at gold.safeguard.sh/scan can list known issues in its libraries. It will not find a flaw in the app's own code, so the code review above is still needed.
What to do now
- List every deployment of Student Record System and decide which ones must stay online.
- Take internet exposure away. Put the app behind a VPN or an IP allow list, or switch it off until it is fixed.
- Change the code that builds the query for
/login.phpto use prepared statements. A minimal pattern in PHP looks like this:
$stmt = $con->prepare("SELECT id FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();
- Apply the same change to every other query in the app that uses request data, not only this file.
- Give the database account the least access it needs, with no rights to other schemas and no file or admin privileges.
- Check for a newer vendor release and compare its notes with this CVE. If the vendor has gone quiet, plan to replace the software.
- If real data lives in the system, preserve logs and a database copy, review them for unusual reads, and rotate passwords stored in it.
Why it matters
A student record system holds names, identifiers, grades and the credentials staff use to sign in. A login page is also the first page an outsider reaches, so a weakness there is reachable before any account exists.
SQL injection happens when the text a user sends becomes part of a database command instead of staying plain data. It is among the oldest and best understood classes of bug. Prepared statements prevent it, and that is why it keeps showing up in small PHP applications written without them. The affected file is a user facing page rather than an admin only one, which makes it easier for an outsider to reach.
Student data is often covered by privacy rules. If this software holds real records, involve whoever owns data protection at your school or organization when you assess exposure.
Quick check
Is CVE-2025-5216 fixed?
The CVE record lists no fixed version for Student Record System 3.20. Check the vendor and project pages, and until a patched release exists, reduce exposure and fix the query code yourself.
Is this being exploited in the wild?
The record says an exploit has been disclosed to the public, but the CISA Known Exploited Vulnerabilities flag is false. Public exploit details raise the chance of attacks, so act as though scanning is likely.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-5216
- CVE record data for CVE-2025-5216, including the VulDB entry and the issue tracker link it lists. The vendor pages and VulDB could not be retrieved while this post was written, so confirm fixed versions with the vendor.
Last reviewed: 18 October 2026.
