CVE-2024-12977
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Complaint Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'state' parameter in /admin/state.php. This can lead to data theft, manipulation, or complete system compromise. Organizations using this specific software version are affected.
💻 Affected Systems
- PHPGurukul Complaint Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive complaint data, user credentials, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Data exfiltration of complaint records, user information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to the specific vulnerable table.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or proper input sanitization to the state.php file
Modify /admin/state.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM states WHERE state_name = ?'); $stmt->bind_param('s', $_POST['state']);
Web Application Firewall Rules
allBlock SQL injection patterns targeting the /admin/state.php endpoint
Add WAF rule: SecRule REQUEST_URI "@streq /admin/state.php" "id:1001,phase:2,deny,status:403,msg:'Blocking SQLi attempt on state.php'"
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules to only trusted IP addresses
- Implement database-level controls: restrict application database user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Test the /admin/state.php endpoint with SQL injection payloads like: state=test' OR '1'='1Check Version:
Check the software version in the application interface or configuration filesVerify Fix Applied:
Attempt the same SQL injection payloads and verify they are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or SQL errors in application logs
Network Indicators:
- HTTP POST requests to /admin/state.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri="/admin/state.php" AND (payload="' OR" OR payload="UNION" OR payload="SELECT")🔗 References
- https://github.com/AngrySheep2003/cve/blob/main/Complaint_Management_System_SQL_Injection.md
- https://phpgurukul.com/
- https://vuldb.com/?ctiid.289353
- https://vuldb.com/?id.289353
- https://vuldb.com/?submit.469112
- https://github.com/AngrySheep2003/cve/blob/main/Complaint_Management_System_SQL_Injection.md
