CVE-2025-4772 Details

A critical SQL injection vulnerability has been identified in PHPGurukul Online Course Registration version 3.1, specifically within the admin/department.php file. The vulnerability arises from inadequate input validation of the department parameter, allowing attackers to inject malicious SQL queries. This exploitation can be performed remotely, without the need for authentication, leading to unauthorized access and manipulation of the database.

To address this vulnerability, it is recommended to implement prepared statements and parameter binding to prevent SQL injection. Additionally, input validation and filtering should be applied to ensure that user input meets expected formats, blocking malicious data. Finally, database user permissions should be minimized, granting only the necessary access rights to the database account used by the application.