CVE-2025-8156 Details

A critical SQL injection vulnerability has been identified in PHPGurukul User Registration & Login and User Management System with Admin Panel, version 3.3. The issue resides in the admin file 'lastsevendays-reg-users.php', where the 'id' parameter is not properly sanitized. This lack of validation allows authenticated attackers to inject arbitrary SQL queries, exploiting the application using time-based blind SQL injection techniques. The vulnerability could be used to bypass filters and extract sensitive information from the database, such as user data including emails and phone numbers, and potentially to escalate privileges by chaining with other vulnerabilities.

It is recommended to replace the vulnerable SQL query with a parameterized statement using prepared statements, which properly sanitize user input before executing the query. Additionally, all user input should be validated and sanitized to prevent SQL injection vulnerabilities.