CVE-2024-34987
📋 TL;DR
This SQL injection vulnerability in PHPGurukul Online Fire Reporting System allows attackers to bypass authentication by injecting malicious SQL commands into the username field during login. Attackers can gain unauthorized administrative access to the system. Organizations using PHPGurukul Online Fire Reporting System 1.2 are affected.
💻 Affected Systems
- PHPGurukul Online Fire Reporting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access, modify, or delete all fire reporting data, potentially install backdoors, and pivot to other systems.
Likely Case
Unauthorized administrative access leading to data theft, system manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation, WAF protection, and monitoring detecting exploitation attempts.
🎯 Exploit Status
Simple SQL injection requiring no authentication, with public exploit code available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Review vendor website for updates
2. If no patch available, implement workarounds
3. Consider replacing with alternative software
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to the login script
Modify ofrs/admin/index.php to use prepared statements with PDO or mysqli
Web Application Firewall Rules
allBlock SQL injection patterns targeting the admin login endpoint
Add WAF rule: Block requests to /ofrs/admin/index.php containing SQL keywords in username parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit lateral movement if compromised
🔍 How to Verify
Check if Vulnerable:
Test the login page at /ofrs/admin/index.php with SQL injection payloads in username fieldCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Attempt SQL injection after implementing fixes and verify login fails with malicious input📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with SQL keywords in username field
- Successful admin logins from unusual IP addresses
Network Indicators:
- HTTP POST requests to /ofrs/admin/index.php containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri="/ofrs/admin/index.php" AND (username CONTAINS "' OR" OR username CONTAINS "--" OR username CONTAINS "UNION")