CVE-2025-1901
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Restaurant Table Booking System 1.0 allows attackers to manipulate database queries through the username parameter in /admin/check_availability.php. Attackers can potentially read, modify, or delete database contents, and the attack can be launched remotely without authentication. All users running the vulnerable version are affected.
💻 Affected Systems
- PHPGurukul Restaurant Table Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution through database functions.
Likely Case
Unauthorized access to sensitive data (customer information, booking details, admin credentials), data manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit available on GitHub, simple SQL injection technique with remote execution capability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to /admin/check_availability.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE username = ?'); $stmt->bind_param('s', $username);
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:username "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Restrict access to /admin/ directory using IP whitelisting or authentication
- Disable or remove the vulnerable check_availability.php file if functionality is non-critical
🔍 How to Verify
Check if Vulnerable:
Test the /admin/check_availability.php endpoint with SQL injection payloads like: username=admin' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads and verify no database errors or unexpected behavior occurs📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in PHP/application logs
- Unusual database queries from web server IP
- Multiple failed login attempts with SQL payloads
Network Indicators:
- HTTP POST requests to /admin/check_availability.php with SQL keywords
- Unusual database port traffic from web server
SIEM Query:
source="web_logs" AND uri="/admin/check_availability.php" AND (username="*'*" OR username="*OR*" OR username="*UNION*" OR username="*SELECT*")