CVE-2025-3350
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Old Age Home Management System allows attackers to manipulate database queries through the viewid parameter in /admin/view-enquiry.php. Attackers can potentially read, modify, or delete sensitive data from the database. Organizations using version 1.0 of this software are affected.
💻 Affected Systems
- PHPGurukul Old Age Home Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of sensitive personal/medical data, administrative account takeover, and potential system-wide data destruction.
Likely Case
Unauthorized access to personal information of residents and staff, potential privilege escalation to admin accounts, and data manipulation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or limited data exposure.
🎯 Exploit Status
Exploit requires admin panel access. The vulnerability is in the admin interface at /admin/view-enquiry.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or proper input sanitization to the viewid parameter in view-enquiry.php
Modify /admin/view-enquiry.php to use prepared statements with parameterized queries
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns targeting the viewid parameter
Add WAF rule: Block requests containing SQL keywords in viewid parameter
🧯 If You Can't Patch
- Restrict access to /admin/ directory to specific IP addresses only
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the viewid parameter in /admin/view-enquiry.php with SQL injection payloads like ' OR '1'='1Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test that SQL injection payloads no longer execute and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application
- Multiple failed login attempts to admin panel
- SQL error messages in application logs
Network Indicators:
- HTTP requests to /admin/view-enquiry.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/admin/view-enquiry.php" AND (param="viewid" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and)")