CVE-2025-57146 identifies an SQL Injection vulnerability in phpgurukul Complaint Management System in PHP 2.0. The issue exists in the user/reset-password.php file, specifically through the mobileno parameter, which is not properly sanitized. This allows remote attackers to inject SQL code without authentication, potentially compromising the confidentiality and integrity of the database. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). No patch or vendor advisory is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation could allow an attacker to read or modify sensitive data in the backend database, impacting confidentiality and integrity. There is no reported impact on system availability. The vulnerability requires user interaction (UI:R) but no privileges or authentication (PR:N). No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the mobileno parameter in user/reset-password.php to prevent SQL Injection. Monitor vendor channels for updates and apply patches promptly once released.