CVE-2025-6330 is a High severity (CVSS 7.3) SQL injection in PHPGurukul Directory Management System 1.0, in the searchdata parameter of /searchdata.php. The record lists no fixed version. Treat the product as unpatched: limit who can reach it, switch the query to prepared statements, and check the vendor or project site for an update.
The weakness is catalogued as CWE-74, CWE-89. The Gold page for the CVE is CVE-2025-6330 on Gold.
What's affected
The record names one product and one version:
- PHPGurukul Directory Management System 1.0
- Vulnerable file: /searchdata.php
- Vulnerable parameter: searchdata
- Fixed version: none listed in the record
This is a small PHP application of the kind often installed from a download site and run as is, so there is usually no package manager entry and no automatic update channel. You need to know that you installed it and where. No account is needed to reach it, according to the CVSS vector.
How to check if you're exposed
Start with inventory. Find out whether Directory Management System is installed on any server you run, including test and demo machines. A search of web roots is a reasonable first pass:
find /var/www -type f -name "searchdata.php" 2>/dev/null
If the file turns up, open it and read how the query is built. Look for variables from the request being placed straight into a SQL string instead of being passed as bound values:
grep -n "SELECT\|INSERT\|UPDATE\|DELETE" searchdata.php
grep -n "_GET\|_POST\|_REQUEST" searchdata.php
If a request value such as searchdata reaches the SQL text through string concatenation, the code matches the pattern in the record. Also check the database account the app uses and the web server access logs for unusual requests to the named file. The record does not describe indicators, so treat any log review as general hygiene rather than a confirmed detection.
What to do now
- Decide whether the application needs to be internet facing at all. If it does not, move it behind a VPN or an IP allowlist today.
- Check the vendor or project site for a newer release. The record lists no fixed version, so do not assume one exists.
- If you maintain the code, replace string built queries in searchdata.php with prepared statements and bound parameters, and validate input types.
- Repeat the review on every other file that talks to the database, because the same pattern is likely elsewhere.
- Reduce the database account to the minimum rights the app needs, so a flaw in one query cannot touch everything.
- Run your own scan to find similar issues. Safeguard offers a free in-browser dependency scan for projects that use package managers, and the Gold directory lists records like this one.
Why it matters
SQL injection happens when input is mixed into a database command in a way that lets the input change the command itself. It is one of the oldest and best understood web flaws, and the fix is also well understood: keep code and data separate with parameterized queries. The record maps the issue to CWE-74, CWE-89, which is the general injection class plus the SQL specific entry.
The record says the exploit has been disclosed to the public and may be used. That is a statement about published details, not a statement that attacks have been seen, and the CVE is not on the CISA Known Exploited Vulnerabilities list as far as the record shows. A caution about the label: the VulDB wording calls the issue critical, while the CVSS 3.1 base score of 7.3 sits in the high band. We use the score for the headline. Your own risk depends on what data sits behind the application.
Quick check
Is CVE-2025-6330 known to be exploited in the wild?
The record does not mark it as listed in the CISA Known Exploited Vulnerabilities catalog, and it gives no report of attacks. It does say exploit details have been disclosed publicly.
Is there a patched version of Directory Management System?
The record lists no fixed version. Check the vendor or project site, and until you find one, restrict access and fix the query in searchdata.php yourself if you maintain the code.
Sources
References listed in the CVE record (not independently fetched for this review):
- https://github.com/f1rstb100d/myCVE/issues/77
- https://phpgurukul.com/
- https://vuldb.com/?ctiid.313326
- https://vuldb.com/?id.313326
- https://vuldb.com/?submit.596532
Last reviewed: 18 October 2026.
