Medium · 6.5 CVE-2025-65380 EUVD-2025-200326GHSA-9cpm-2q59-cph3

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts …

Published Dec 2, 2025 · Updated Dec 2, 2025 · Assigned by mitre

Description

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

References

https://phpgurukul.com/billing-system-using-php-and-mysql
https://github.com/dewcode91/security-research/blob/main/CVE-2025-65380.md