CVE-2025-6155: High SQL Injection in PHPGurukul Hostel Mgmt

CVE-2025-6155 is a high (CVSS 7.3) SQL injection flaw in PHPGurukul Hostel Management System 1.0. The record says /includes/login-hm.inc.php passes the Username argument into a database query unsafely, and a public exploit has been disclosed. Fix status: no fixed version is named.

What's affected

• Product: PHPGurukul Hostel Management System 1.0.
• Affected version: 1.0.
• Vulnerable file and argument: /includes/login-hm.inc.php, parameter Username.
• Weaknesses: CWE-89 (SQL injection) and CWE-74 (injection).
• Fixed version: None is named in the CVE record. Check the vendor or project page for any update before relying on this.
• Access needed: no login required. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
• Public exploit: the record says the exploit has been disclosed to the public and may be used.
• Known exploited: no, the record is not flagged by CISA KEV.

The score for this entry is 7.3 (High). Read the description carefully for the vendor wording, because some of these projects have no maintained release channel.

How to check if you're exposed

First confirm whether you run this software at all. Look at your application inventory, web roots, container images and any package lists for PHPGurukul Hostel Management System 1.0. If you cannot find it, make sure no team has deployed it as a side project, because tools of this kind are often installed once and forgotten.

Then confirm the version. The record names 1.0 as affected.

# find the vulnerable file in your deployment
find /var/www -name "login-hm.inc.php" 2>/dev/null

# review how it builds its query (look for string concatenation with request values)
grep -n "Username" includes/login-hm.inc.php | head
grep -n "mysqli_query\|->query(\|mysql_query" includes/login-hm.inc.php | head

Replace /var/www with your web root. If you see request values joined into a query string, you have the weakness the record describes.

Look for the path /includes/login-hm.inc.php in web server logs. Requests to it carrying quote characters, comment markers or SQL keywords in the Username value are worth a closer look. A clean log does not prove you are safe, but unusual hits tell you to treat the system as compromised and rotate any credentials the database holds.

What to do now

1. Find every deployment of PHPGurukul Hostel Management System 1.0 and note the version.
2. Check the vendor or project page and the references in the CVE record for a patch. The record names none, so do not assume one exists.
3. If you cannot patch, remove the application from the internet or put it behind a VPN or an authenticating reverse proxy.
4. Add a web application firewall rule for SQL injection patterns on /includes/login-hm.inc.php as a stopgap. It reduces risk but is not a fix.
5. If you maintain the code, change the query to use prepared statements with bound parameters, and validate the Username value.
6. Make sure the application connects to the database with an account that has only the permissions it needs, and rotate the credentials if you suspect misuse.
7. Rescan the project with the free in-browser dependency scan so the dependency and code findings are tracked in one place.

Why it matters

This is a classic injection weakness, listed as CWE-89 with the broader CWE-74. The query is assembled from request data without parameter binding, so input can alter its meaning.

The fix is well understood and has been for decades: prepared statements with bound parameters, plus input validation as a second layer. The reason the bug keeps appearing in small web projects is that string concatenation works in a demo and nobody reviews it afterwards.

If no vendor fix appears, the lasting answer is to replace the software. If PHPGurukul Hostel Management System 1.0 is running anywhere that handles real data, plan that replacement now. The record does not mark this entry as exploited in the wild. It does say the exploit is public, which lowers the effort for anyone who wants to try it, so expose-and-forget deployments are the ones to fix first.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-6155
• github.com/zzb1388/cve/issues/3 (listed in the CVE record, not fetched)
• phpgurukul.com/ (listed in the CVE record, not fetched)
• vuldb.com/?ctiid.312630 (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.