CVE-2024-10300
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Medical Card Generation System 1.0 allows attackers to manipulate database queries through the viewid parameter on the admin view-enquiry.php page. Attackers can potentially read, modify, or delete database content. All installations of version 1.0 with the vulnerable component exposed are affected.
💻 Affected Systems
- PHPGurukul Medical Card Generation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive medical data theft, authentication bypass, remote code execution, or system takeover.
Likely Case
Unauthorized data access and extraction of sensitive information from the database, potentially including patient records and administrative credentials.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and database permissions restricting unauthorized access.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable page. SQL injection techniques are well-documented and easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in /admin/view-enquiry.php, validate and sanitize viewid input, and apply proper input validation.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure viewid parameter contains only expected values (e.g., numeric IDs)
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the /admin/view-enquiry.php endpoint
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the /admin/view-enquiry.php endpoint with SQL injection payloads in the viewid parameter (e.g., viewid=1' OR '1'='1)Check Version:
Check application files or documentation for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer produce database errors or unexpected behavior📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by access to /admin/view-enquiry.php
- HTTP requests with SQL keywords in viewid parameter
Network Indicators:
- HTTP POST/GET requests to /admin/view-enquiry.php containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri="/admin/view-enquiry.php" AND (query_string CONTAINS "UNION" OR query_string CONTAINS "SELECT" OR query_string CONTAINS "OR '1'='1'")