CVE-2024-12999
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in the /admin/edit-user.php file in PHPGurukul Small CRM 1.0. Attackers can potentially access, modify, or delete database content. Organizations using PHPGurukul Small CRM 1.0 are affected.
💻 Affected Systems
- PHPGurukul Small CRM
📦 What is this software?
Small Crm by Phpgurukul
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to execute arbitrary commands.
Likely Case
Unauthorized access to sensitive CRM data including user credentials, customer information, and business records.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit requires access to admin interface but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If no patch available, implement workarounds. 3. Consider migrating to supported software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to the edit-user.php file
Modify /admin/edit-user.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE id = ?'); $stmt->bind_param('i', $id);
Access Restriction
linuxRestrict access to admin interface using IP whitelisting or additional authentication
Add .htaccess rules: Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Isolate the CRM system in a segmented network with strict access controls
🔍 How to Verify
Check if Vulnerable:
Test the /admin/edit-user.php?id=1' endpoint for SQL error responses or unexpected behaviorCheck Version:
Check CRM version in admin panel or read version.txt file if presentVerify Fix Applied:
Test with SQL injection payloads like id=1' OR '1'='1 and verify proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin access
- Requests to /admin/edit-user.php with SQL syntax in parameters
Network Indicators:
- Unusual database connection patterns from web server
- Large data transfers from CRM database
SIEM Query:
source="web_logs" AND uri="/admin/edit-user.php" AND (param="%27" OR param="--" OR param="UNION" OR param="SELECT")