CVE-2024-5065
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Online Course Registration System 3.1 allows remote attackers to execute arbitrary SQL commands via the 'regno' parameter. Unauthenticated attackers can potentially access, modify, or delete database content. All systems running the vulnerable version are affected.
💻 Affected Systems
- PHPGurukul Online Course Registration System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, data exfiltration, and potential authentication bypass leading to system compromise.
If Mitigated
Limited impact with proper input validation, parameterized queries, and WAF protection blocking malicious SQL patterns.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries in the affected code or migrating to a supported alternative.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the 'regno' parameter to only accept expected formats
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test the /onlinecourse/ endpoint with SQL injection payloads in the 'regno' parameter and observe database errors or unexpected responses.Check Version:
Check the system documentation or configuration files for version information, typically found in readme files or admin panels.Verify Fix Applied:
After implementing fixes, test with the same SQL injection payloads to ensure they are properly rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL patterns
- Unexpected database queries from application user
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in the 'regno' parameter
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND (url="/onlinecourse/" AND (param="regno" AND value MATCHES "(?i)(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|OR|AND)"))🔗 References
- https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%203%20(Unauthenticated).md
- https://vuldb.com/?ctiid.264924
- https://vuldb.com/?id.264924
- https://vuldb.com/?submit.336239
- https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%203%20(Unauthenticated).md
- https://vuldb.com/?ctiid.264924
- https://vuldb.com/?id.264924
- https://vuldb.com/?submit.336239
