CVE-2024-51064
📋 TL;DR
This SQL injection vulnerability in Phpgurukul Teachers Record Management System v2.1 allows attackers to execute arbitrary SQL commands via the tid parameter in admin/queries.php. This affects all organizations using the vulnerable version of this software, potentially exposing sensitive teacher and student data.
💻 Affected Systems
- Phpgurukul Teachers Record Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Extraction of sensitive teacher/student records, administrative credentials, and personal information from the database.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though SQL injection attempts may still be logged.
🎯 Exploit Status
Exploitation requires admin access to reach the vulnerable endpoint. SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://phpgurukul.com
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If patch available, download and replace affected files. 3. Validate parameter sanitization in admin/queries.php.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and use prepared statements for the tid parameter
Modify admin/queries.php to use PDO prepared statements or mysqli_real_escape_string()
Access Restriction
allRestrict access to admin/queries.php endpoint
Add .htaccess rules to restrict IP access or implement additional authentication
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict network access to the application and monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test the tid parameter in admin/queries.php with SQL injection payloads like ' OR '1'='1Check Version:
Check version in application interface or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer work and that prepared statements are implemented📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from admin/queries.php
Network Indicators:
- SQL injection patterns in HTTP requests to admin/queries.php
SIEM Query:
source="web_logs" AND uri="*/admin/queries.php*" AND (payload="' OR" OR payload="UNION" OR payload="SELECT *")