CVE-2025-7160: A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

1.72%

74.8th percentile

A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
phpgurukul	zoo_management_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/admin/index.php↗

commandusername=admin%27+or+%271%27%3D%271&password=any&login=↗

→Detect SQL injection auth-bypass attempts against /admin/index.php by matching POST body containing the classic OR-based SQLi payload in the username parameter. ↗
→A successful exploitation response will contain all three strings in the HTTP body: 'ZMS ADMIN', 'Dashboard', and 'Zoo Management System', with HTTP status 200 — use these as confirmation of auth bypass. ↗
→The attack is delivered via HTTP POST to /admin/index.php with Content-Type: application/x-www-form-urlencoded; monitor for unauthenticated POST requests to this endpoint with SQL metacharacters (single-quote, OR) in the username field. ↗
→The vulnerability is exploitable remotely with no authentication required (PR:N, UI:N); prioritize perimeter detection on any internet-exposed Zoo Management System 2.1 login endpoints. ↗

·The Nuclei template targets Zoo Management System 1.0 but the NVD entry references version 2.1; the same /admin/index.php username SQLi vector appears to apply to both versions — validate the target version before tuning detection thresholds. ↗
·The template uses host-redirects with max-redirects: 2, meaning the exploit payload may be delivered after one or more HTTP redirects; detection rules must follow redirect chains to the final POST destination. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.