CVE-2025-4072 Details

A critical SQL injection vulnerability has been identified in the PHPGurukul Online Nurse Hiring System version 1.0. The issue arises in the file '/admin/edit-nurse.php', where user input from the 'MULTIPART mobilenumber' parameter is not properly validated or sanitized before being used in SQL queries. This oversight allows attackers to inject malicious SQL code, potentially leading to unauthorized database access, data manipulation, and exploitation of the underlying system. The vulnerability can be exploited remotely.

To address this vulnerability, implement prepared statements and parameter binding to separate SQL code from user input. Additionally, validate and filter user input to ensure it meets expected formats, and restrict database user permissions to the minimum necessary.