CVE-2024-13084
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Land Record System 1.0 allows attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-property.php. Attackers can potentially access, modify, or delete database records. Organizations using this software are affected.
💻 Affected Systems
- PHPGurukul Land Record System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or system takeover via SQL injection to execute arbitrary commands.
Likely Case
Unauthorized access to sensitive land record data, potential data exfiltration, and database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to specific tables.
🎯 Exploit Status
Exploit requires admin access to reach /admin/search-property.php. SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize searchdata parameter before processing
Modify /admin/search-property.php to validate searchdata input using PHP filter functions
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in searchdata parameter
🧯 If You Can't Patch
- Restrict access to /admin/search-property.php using IP whitelisting or authentication requirements
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test /admin/search-property.php with SQL injection payloads in searchdata parameter (e.g., searchdata=' OR '1'='1)Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by search-property.php access
- SQL syntax errors in application logs
Network Indicators:
- HTTP POST requests to /admin/search-property.php with SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/admin/search-property.php" AND (param="searchdata" AND value CONTAINS "OR" OR value CONTAINS "UNION" OR value CONTAINS "SELECT")