CVE-2024-12228
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Complaint Management System 1.0 allows attackers to manipulate database queries through the search parameter in /admin/user-search.php. Attackers can potentially read, modify, or delete database contents, and the attack can be launched remotely without authentication. All users running the vulnerable version are affected.
💻 Affected Systems
- PHPGurukul Complaint Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to admin, and potential server takeover via SQL injection to RCE chain
Likely Case
Unauthorized data access, data manipulation, and potential administrative account takeover
If Mitigated
Limited impact with proper input validation and database permissions, but still potential for information disclosure
🎯 Exploit Status
Exploit details publicly disclosed on GitHub, simple SQL injection payloads can be used
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize search parameter before processing
Modify /admin/user-search.php to add: $search = mysqli_real_escape_string($con, $_POST['search']);
Access Restriction
allRestrict access to admin directory via .htaccess or web server configuration
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
location /admin { deny all; }
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting /admin/user-search.php
- Restrict network access to the application, place behind VPN or internal network only
🔍 How to Verify
Check if Vulnerable:
Test /admin/user-search.php with SQL injection payloads like ' OR '1'='1 in search parameterCheck Version:
Check application files for version information, typically in readme.txt or config filesVerify Fix Applied:
Test with same payloads and verify no database errors or unexpected results📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server IP
- Multiple failed login attempts followed by search queries
Network Indicators:
- HTTP POST requests to /admin/user-search.php with SQL keywords
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/user-search.php" AND (search="*OR*" OR search="*UNION*" OR search="*SELECT*")