CVE-2025-5860 is a high severity (CVSS 7.3) SQL injection in PHPGurukul Maid Hiring Management System 1.0. The searchdata argument in /admin/search-booking-request.php is used in a database query unsafely, and the record says the exploit is public. The record lists no fixed version, so remove the app from public view or have its queries rewritten.
What's affected
PHPGurukul Maid Hiring Management System 1.0, per the record. The record does not say whether later versions are fixed.
The file named in the record is /admin/search-booking-request.php, and the argument is searchdata.
No vendor fix is listed. The vendor's site is linked in the record but may not publish security notes.
How to check if you're exposed
This is a small PHP application, so start by finding out whether you run it and where.
find /var/www -type d -iname "*maid*hiring*management*system*" 2>/dev/null
grep -rn "searchdata" --include=*.php /path/to/app | head
Look at the file named in the record, /admin/search-booking-request.php, and see whether the searchdata value is placed directly into a query string. Check web server logs for requests to that page with unusual or very long values.
What to do now
- Find out whether the application runs anywhere in your organization, including test servers and student or demo projects.
- Take it off the public internet, or put it behind a login, a VPN or an IP allow list.
- Have a developer replace string built queries with prepared statements, and validate input types.
- Run the application's database account with minimum privileges, and back up the database before you change anything.
- Search logs for unusual requests to the named page, and review the data for unexpected changes.
- Put the application behind a VPN, an allow list or a reverse proxy login if it must stay online.
- Take a backup of the database before changing anything, so you can compare data afterwards.
Why it matters
The record states that the searchdata argument leads to SQL injection. The value is taken from the request and joined into the text of a database query, so it can change the meaning of the query.
The record classifies the weakness as CWE-74 (Injection) and CWE-89 (SQL Injection).
Small open source and demo style PHP projects rarely get security review, and the public reports for them tend to be short. That does not make the weakness minor. If an application like this faces the internet, anyone can try the published input on it, and the record notes that the exploit details are already public.
The honest advice for software of this kind is to ask whether it needs to be exposed at all. If it does, put it behind a login or an allow list, and have a developer replace string built queries with prepared statements.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch?
The record lists none. Without a vendor fix, the safe options are to remove the app from public access or have its queries rewritten with prepared statements.
What does the searchdata argument have to do with it?
The record says manipulating that argument leads to SQL injection, so that is the value to check in the code.
Sources
Last reviewed: 18 October 2026.
