Medium · 6.1 CVE-2025-28011 EUVD-2025-6304GHSA-5fhm-w463-rhq6

A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows…

Published Mar 13, 2025 · Updated Mar 19, 2025 · Assigned by mitre

Description

A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter.

References

https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Change-password-sql-injection.pdf