Critical severity · published Nov 16, 2025
CVE-2025-13247
PHPGurukul Tourism Management System user-bookings.php sql injection
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.php. The manipulation of the argument uid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
Tourism Management System · PHPGurukul
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13247
Exploit
https://github.com/L-Bitter/CVE/issues/3
Product
https://phpgurukul.com/
Permissions Required
https://vuldb.com/?ctiid.332581
Third Party Advisory
https://vuldb.com/?id.332581
Third Party Advisory
https://vuldb.com/?submit.687578
More from Tourism Management System
8.8
CVE-2024-32254
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php
8.8
CVE-2020-28136
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable…
8.1
CVE-2024-32256
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php
6.1
CVE-2024-41333
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via…
6.1
CVE-2024-1822
PHPGurukul Tourism Management System user-bookings.php cross site scripting