CVE-2025-7155 MEDIUM

CVE-2025-7155: PHPGurukul Online Notes Sharing System Cookie Dashboard sql injection

Vendor Phpgurukul
Product Online Notes Sharing System
Weakness CWE-89 · SQLi
Published July 8, 2025
Last update July 8, 2025

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability, which was classified as critical, was found in PHPGurukul Online Notes Sharing System 1.0. This affects an unknown part of the file /Dashboard of the component Cookie Handler. The manipulation of the argument sessionid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The original researcher disclosure suspects an XPath Injection vulnerability; however, the provided attack payload appears to be characteristic of an SQL Injection attack.

Key dates

02Disclosure timeline

July 8, 2025 CVE published
July 8, 2025 Record updated