CVE-2024-53480
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the emailcont parameter in login.php. It affects all users of Phpgurukul's Beauty Parlour Management System v1.1, potentially leading to authentication bypass, data theft, or complete system compromise.
💻 Affected Systems
- Phpgurukul Beauty Parlour Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, authentication bypass, privilege escalation, and potential remote code execution via database functions.
Likely Case
Authentication bypass allowing unauthorized access to the management system, followed by data theft or manipulation of beauty parlour records.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns.
🎯 Exploit Status
SQL injection in login page requires no authentication and has public proof-of-concept available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://phpgurukul.com
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If patch available, download and replace affected files 3. Test login functionality
🔧 Temporary Workarounds
Input Validation Patch
allManually add input validation to login.php to sanitize emailcont parameter
Edit login.php and add: $emailcont = mysqli_real_escape_string($conn, $_POST['emailcont']);
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:emailcont "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement network segmentation to isolate the system from internet access
- Deploy intrusion detection system monitoring for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payload: emailcont=admin' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Attempt SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL syntax
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/login.php" AND (param="emailcont" AND value MATCHES "'.*OR.*'")