CVE-2025-13247
📋 TL;DR
This SQL injection vulnerability in PHPGurukul Tourism Management System 1.0 allows attackers to manipulate database queries through the uid parameter in /admin/user-bookings.php. Remote attackers can potentially access, modify, or delete sensitive data. All users running the affected version are vulnerable.
💻 Affected Systems
- PHPGurukul Tourism Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, personal data, and administrative access leading to system takeover
Likely Case
Data exfiltration of sensitive booking information, user details, and potential privilege escalation
If Mitigated
Limited data exposure if proper input validation and database permissions are configured
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually or replacing the system.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize uid parameter before processing
// In /admin/user-bookings.php, add: $uid = filter_var($_GET['uid'], FILTER_VALIDATE_INT); if(!$uid) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the user-bookings.php endpoint
ModSecurity rule: SecRule ARGS_GET:uid "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the system behind a WAF with SQL injection protection rules
- Restrict network access to only trusted IP addresses and disable remote admin access
🔍 How to Verify
Check if Vulnerable:
Test the /admin/user-bookings.php endpoint with SQL injection payloads like: /admin/user-bookings.php?uid=1' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads after implementing fixes - should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts after SQL payloads
- Admin panel access from unusual IPs
Network Indicators:
- HTTP requests to /admin/user-bookings.php with SQL keywords in parameters
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri_path="/admin/user-bookings.php" AND (query_string="*OR*" OR query_string="*UNION*" OR query_string="*SELECT*")