CVE-2025-70892 Details
Description
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.
A SQL injection vulnerability has been identified in Phpgurukul Cyber Cafe Management System version 1.0, specifically within the user management module. The issue arises in the 'add-users.php' endpoint, where the application inadequately validates user input in the 'username' parameter. This lack of proper input sanitization allows attacker-controlled data to be directly executed in SQL queries, potentially leading to unauthorized database access and data manipulation.
To address this vulnerability, implement prepared statements to ensure SQL queries are parameterized and not directly influenced by user input. Apply strict server-side input validation and sanitize all user-supplied data before processing. Additionally, use database accounts with least privilege access and change default administrative credentials after installation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/efekaanakkar/Cyber-Cafe-Management-System-CVEs/tree/main/CVE-2025-70892 | [email protected] | ExploitMitigationThird Party Advisory |
| https://phpgurukul.com/cyber-cafe-management-system-using-php-mysql/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| phpgurukul cyber cafe management system | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 22, 2026 | Initial Analysis | [email protected] |
| Jan 15, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | New CVE Received | [email protected] |