CVE-2024-10296
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in PHPGurukul Medical Card Generation System 1.0. Attackers can exploit this by manipulating date parameters in the card reports functionality to execute arbitrary SQL commands. Organizations using this medical card system are affected.
💻 Affected Systems
- PHPGurukul Medical Card Generation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or system takeover via SQL injection to execute arbitrary commands.
Likely Case
Unauthorized data access and extraction of sensitive medical card information, potentially including personal health data.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint, but SQL injection itself is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually in the affected PHP file.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation for fromdate and todate parameters to reject malicious input.
Edit /admin/card-bwdates-reports-details.php to validate date format and sanitize inputs
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting date parameters.
🧯 If You Can't Patch
- Restrict access to the /admin/ directory to trusted IP addresses only
- Disable the Medical Card Generation System if not essential
🔍 How to Verify
Check if Vulnerable:
Test the /admin/card-bwdates-reports-details.php endpoint with SQL injection payloads in fromdate/todate parametersCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel followed by report access
Network Indicators:
- HTTP requests to /admin/card-bwdates-reports-details.php with suspicious date parameters containing SQL syntax
SIEM Query:
source="web_logs" AND uri="/admin/card-bwdates-reports-details.php" AND (param="fromdate" OR param="todate") AND (value="' OR" OR value="' UNION" OR value="' SELECT")