CVE-2024-13001
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks via the email parameter in PHPGurukul Small CRM 1.0's admin/index.php file. Attackers can potentially access, modify, or delete database content. All users running Small CRM 1.0 are affected.
💻 Affected Systems
- PHPGurukul Small CRM
📦 What is this software?
Small Crm by Phpgurukul
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive CRM data including customer information, financial records, and administrative credentials.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns.
🎯 Exploit Status
Exploit disclosed publicly; SQL injection via email parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the email parameter in admin/index.php.
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE email = ?'); $stmt->bind_param('s', $email);
Web Application Firewall Rules
linuxDeploy WAF rules to block SQL injection patterns targeting the /admin/index.php endpoint.
Add ModSecurity rule: SecRule ARGS:email "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Restrict access to /admin/index.php using IP whitelisting or network segmentation.
- Monitor and alert on unusual database queries or admin login attempts.
🔍 How to Verify
Check if Vulnerable:
Test the email parameter in /admin/index.php with SQL injection payloads like ' OR '1'='1.Check Version:
Check CRM version in admin panel or via version file if present.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return error pages or are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Requests with SQL keywords in email parameter
Network Indicators:
- HTTP requests to /admin/index.php with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri_path="/admin/index.php" AND (email="*OR*" OR email="*UNION*" OR email="*SELECT*")