CVE-2025-11416 is a High severity (CVSS 7.3) SQL injection in PHPGurukul Beauty Parlour Management System 1.1. The delid argument handled by /admin/invoices.php can change the database query. The record names no patched release, so restrict access, switch the query to prepared statements and ask the vendor for a fix.
What's affected
The record lists PHPGurukul Beauty Parlour Management System 1.1. The affected file is /admin/invoices.php, and the argument named in the record is delid. The weakness types are CWE-74 (injection) and CWE-89 (SQL injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable with no login needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates. The same product has other CVEs in this period, including CVE-2025-11415. A product with several injection points usually has more, so plan a review of the whole code base rather than one page.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 1.1, so treat other versions as unverified rather than safe.
Then look at the code. From the application's root directory, these commands show where the file lives and how the argument is used:
find . -name "invoices.php"
grep -n "delid" admin/invoices.php
grep -rnE "(mysqli_query|mysql_query)" --include=*.php .
Any hit that builds a query by joining strings with the request value, rather than passing it as a bound parameter, is a candidate for this class of flaw.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list, while you decide what to do.
- Change the query that uses delid so the value is bound as a parameter. Example of the safe shape in PHP:
$stmt = $mysqli->prepare("SELECT id FROM records WHERE name = ?");
$stmt->bind_param("s", $value);
$stmt->execute();
- Give the application's database account only the rights it needs. It should not own the schema or reach other databases.
- Search access logs for requests to /admin/invoices.php that contain unusual characters in the delid field, and keep them if you find any.
- Ask the vendor for a patch. If none is published, plan to replace the application, or maintain your own fixed copy of the code.
- Apply the same fix to every other page that builds queries from request values, since one bug often means several.
Why it matters
SQL injection happens when user input becomes part of a database command instead of being treated as data. The database then cannot tell the developer's intent from the attacker's text. The effect depends on the application and the database account, and ranges from reading rows to changing or deleting them.
This is a long standing weakness class with a standard cure. The tradeoff is that small PHP applications often have no maintainer to ship the cure, so you may need to carry the fix yourself. See CWE-89 for the general pattern.
Quick check
Can I fix CVE-2025-11416 by upgrading PHPGurukul Beauty Parlour?
The record names no fixed release. Check the vendor's site, and apply the code level and network controls in this post in the meantime.
Is CVE-2025-11416 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11416 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
