# CVE-2026-5543: PHPGurukul User Management System SQL injection in yesterday-reg-users.php

Source: https://junglewise.ai/threats/cve-2026-5543-phpgurukul-user-management-system-sql-injection-in-yesterday-reg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5543 · Severity: medium · CVSS 6.3 · Published 2026-04-05

PHPGurukul User Registration & Login and User Management System is a web application used for managing user accounts and administrative tasks. A security vulnerability in the administrative panel allows an attacker to interfere with the application's database. If exploited, this could lead to unauthorized access to sensitive user information, data modification, or disruption of the management system.

Vendors: [Phpgurukul](https://junglewise.ai/threats/vendors/phpgurukul).

## Quick answers

**Is CVE-2026-5543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5543 being exploited in the wild.

**How severe is CVE-2026-5543?** Medium severity, with a CVSS score of 6.3, published 5 April 2026.

**Which products and versions are affected?** Phpgurukul User Registration & Login and User Management System 3.3.

**Is there a fix for CVE-2026-5543?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5543 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5543?** Check whether you run Phpgurukul User Registration & Login and User Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in PHPGurukul User Registration & Login and User Management System 3.3 within the '/admin/yesterday-reg-users.php' component. The root cause is the failure to sanitize or validate the 'id' GET parameter before using it in a database query. An authenticated attacker with access to the admin panel can exploit this via a crafted network request to execute arbitrary SQL commands. This can lead to time-based blind SQL injection, allowing for the extraction of database contents or unauthorized data manipulation. A public proof-of-concept (PoC) using time-based blind techniques (RLIKE SLEEP) has been disclosed.

## Affected products

- PHPGurukul User Registration & Login and User Management System 3.3

## Timeline

- 2026-03-18: disclosed: Initial discovery and PoC shared on GitHub
- 2026-04-05: advisory: CVE published and VulDB entry created

## References

- [https://github.com/f1rstb100d/CVE/issues/4](https://github.com/f1rstb100d/CVE/issues/4)
- [https://phpgurukul.com/](https://phpgurukul.com/)
- [https://vuldb.com/submit/782246](https://vuldb.com/submit/782246)
- [https://vuldb.com/vuln/355296](https://vuldb.com/vuln/355296)
- [https://vuldb.com/vuln/355296/cti](https://vuldb.com/vuln/355296/cti)

## Related threats

- [PHPGurukul User Registration System broken authentication in change password](https://junglewise.ai/threats/cve-2026-105703-a-vulnerability-was-determined-in-phpgurukul-user-registration)