CVE-2025-5599 is a high severity (7.3) SQL injection in PHPGurukul Student Result Management System 1.3, in the file /editmyexp.php. The record names no fixed version, so the fix is to correct the database query in your copy of the code and keep the application away from untrusted networks until you have.
What's affected
The record lists PHPGurukul Student Result Management System 1.3. The affected file is /editmyexp.php. The record says the manipulation of the argument emp1ctc leads to the injection. The description says the attack can be launched remotely and that the exploit has been disclosed to the public.
The record gives a CVSS 3.1 score of 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. It does not give a patched version. The references are a VulDB entry, the vendor's home page and a researcher's issue or write-up, none of which is a vendor security advisory with fixed versions. Check the vendor site for a newer release, and do not assume a later number fixes this until the vendor says so.
The CVE is not marked as exploited in the wild on the CISA KEV list.
How to check if you're exposed
This is a downloadable PHP application, not a package from a registry. A dependency scan will not list it, so the check is about your own deployments.
- Search your hosting inventory for the application name and for the version in the record.
- On each server, confirm the file exists at the path above under the web root.
- Read the code in that file and look for SQL strings that join request values straight into the query text. A search such as
grep -n "mysqli_query\|SELECT\|INSERT\|UPDATE" editmyexp.phprun in the application directory will point you to the lines to read. - Check whether the application is reachable from the internet and whether the page needs a login.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- List every deployment of this application, including demos, staging copies and student or training installs.
- Take public instances offline or place them behind a login, VPN or IP allow list until the code is fixed.
- Change the query in
/editmyexp.phpto use prepared statements with bound parameters, and validate the type and length of each input. - Give the application's database account only the rights it needs. It should not own the schema or reach other databases.
- Check the vendor site for a release newer than 1.3 and read its notes before relying on it.
- Look through web and database logs for unusual values in the
emp1ctcinput and for database errors from that page. - Back up the database before any change, and test the fix on a copy.
Why it matters
The class is CWE-74 and CWE-89: special elements in input reach a downstream interpreter, here the database, without being neutralised. When an application builds a query by pasting user input into a string, the input can change what the query means. The usual impact is reading or altering records the page was never meant to expose, and in some setups more.
This is a family of findings, not an isolated one. Small PHP management systems often share the same coding habit across many pages, so one reported file is rarely the only one. After you fix /editmyexp.php, read the other pages that handle input with the same eyes.
Applications like this are often installed for a course, a pilot or a small office and then left running with default settings. They hold real personal data. A public exploit write-up means the effort needed to attack them is low, so exposure and inventory matter more than the CVSS number.
Quick check
Is there a fixed version of Student Result Management System 1.3?
The CVE record names none. Check the vendor's site for a newer release, and if you keep running this code, fix the query with prepared statements yourself.
Does the CVSS vector mean login is required?
The vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Read the PR value in it: N means no privileges are needed. Confirm on your own deployment how the page is reached.
Sources
- https://github.com/GarminYoung/myCVE/issues/7 (listed in the CVE record)
- https://phpgurukul.com/ (listed in the CVE record)
- https://vuldb.com/?ctiid.311086 (listed in the CVE record)
- https://vuldb.com/?id.311086 (listed in the CVE record)
- https://vuldb.com/?submit.587960 (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-5599
Last reviewed: 18 October 2026.
