CVE-2024-5063
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Online Course Registration System 3.1 allows attackers to bypass authentication via the admin login page. Remote attackers can manipulate username/password parameters to execute arbitrary SQL commands, potentially gaining unauthorized access. Organizations using this specific version of the software are affected.
💻 Affected Systems
- PHPGurukul Online Course Registration System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to steal all user data, modify course registrations, install backdoors, or take full administrative control of the system.
Likely Case
Authentication bypass leading to unauthorized admin access, data exfiltration of student/course information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing lateral movement.
🎯 Exploit Status
Public exploit code is available showing authentication bypass via SQL injection in login parameters. Simple payloads can bypass authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check for official vendor patch or updated version. 2. If unavailable, implement input validation and parameterized queries in /admin/index.php. 3. Replace vulnerable login logic with prepared statements.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in login parameters
# Example ModSecurity rule: SecRule ARGS:username "@detectSQLi" "id:1001,phase:2,deny"
Authentication Rate Limiting
linuxLimit login attempts to reduce brute force and injection attempts
# Apache: SetEnvIf Request_URI ^/admin/index.php max_attempts=5
# Nginx: limit_req_zone $binary_remote_addr zone=admin:10m rate=5r/m;
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit access to the admin interface
🔍 How to Verify
Check if Vulnerable:
Test the /admin/index.php endpoint with SQL injection payloads in username/password fields (e.g., ' OR '1'='1). Monitor for successful authentication bypass.Check Version:
Check the system's about page or configuration files for version 3.1 indicationVerify Fix Applied:
Attempt the same SQL injection payloads after fixes. Successful fixes should reject malicious input and require valid credentials.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL patterns
- Successful admin logins from unusual IPs
Network Indicators:
- HTTP POST requests to /admin/index.php with SQL keywords in parameters
- Unusual traffic patterns to admin interface
SIEM Query:
source="web_logs" AND uri="/admin/index.php" AND (request_body CONTAINS "OR" OR request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT")🔗 References
- https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20Authentication%20Bypass.md
- https://vuldb.com/?ctiid.264922
- https://vuldb.com/?id.264922
- https://vuldb.com/?submit.336236
- https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20Authentication%20Bypass.md
- https://vuldb.com/?ctiid.264922
- https://vuldb.com/?id.264922
- https://vuldb.com/?submit.336236
