CVE-2025-5612
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Online Fire Reporting System 1.2 allows attackers to manipulate database queries via the 'fullname' parameter in reporting.php. Remote attackers can potentially read, modify, or delete database contents. Organizations using this specific version of the fire reporting system are affected.
💻 Affected Systems
- PHPGurukul Online Fire Reporting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive information (user credentials, fire reports, personal data), and potential data manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection is a well-understood attack vector with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize all user inputs, especially the 'fullname' parameter
Edit reporting.php to add: $fullname = mysqli_real_escape_string($connection, $_POST['fullname']);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database access attempts
🔍 How to Verify
Check if Vulnerable:
Test the reporting.php endpoint with SQL injection payloads in the 'fullname' parameterCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Attempt SQL injection after implementing fixes and verify database queries are properly parameterized📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- Multiple failed login attempts from single IP
- SQL syntax errors in application logs
Network Indicators:
- Unusual outbound database connections
- SQL keywords in HTTP POST parameters
SIEM Query:
source="web_logs" AND ("UNION SELECT" OR "' OR '1'='1" OR "sleep(" OR "benchmark(")🔗 References
- https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_reporting_fullname.md
- https://phpgurukul.com/
- https://vuldb.com/?ctiid.311098
- https://vuldb.com/?id.311098
- https://vuldb.com/?submit.589105
- https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_reporting_fullname.md
