CVE-2025-5618
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Online Fire Reporting System 1.2 allows attackers to manipulate database queries through the teamid parameter in /admin/edit-team.php. Attackers can potentially read, modify, or delete database contents remotely. Organizations using this specific version of the fire reporting system are affected.
💻 Affected Systems
- PHPGurukul Online Fire Reporting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive data exfiltration, authentication bypass, privilege escalation, and potential system takeover.
Likely Case
Data theft of fire incident reports, user credentials, and administrative information; potential for system defacement or data manipulation.
If Mitigated
Limited impact with proper input validation and database permissions; potential for error messages revealing system information.
🎯 Exploit Status
Exploit details are publicly available on GitHub; requires authentication to access the admin interface but SQL injection is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing parameterized queries and input validation manually.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure teamid parameter contains only expected values (integers).
Modify /admin/edit-team.php to validate teamid parameter using PHP's filter_var() with FILTER_VALIDATE_INT
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the teamid parameter.
Add WAF rule: Detect and block SQL keywords in teamid parameter for /admin/edit-team.php endpoint
🧯 If You Can't Patch
- Restrict access to /admin/edit-team.php using IP whitelisting or network segmentation
- Implement database user with minimal permissions (read-only where possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the /admin/edit-team.php endpoint with SQL injection payloads in teamid parameter (e.g., teamid=1' OR '1'='1). Monitor for database errors or unexpected responses.Check Version:
Check system documentation or configuration files for version information; no standard command available.Verify Fix Applied:
After implementing fixes, retest with SQL injection payloads; verify proper error handling and no database errors are returned.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs for /admin/edit-team.php
- Multiple failed login attempts followed by SQL injection attempts
- Unusual database queries from web application user
Network Indicators:
- HTTP requests to /admin/edit-team.php with SQL keywords in parameters
- Abnormal response sizes or error messages containing database information
SIEM Query:
source="web_logs" AND uri="/admin/edit-team.php" AND (param="teamid" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP")🔗 References
- https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_admin_edit-team.php_teamid.md
- https://phpgurukul.com/
- https://vuldb.com/?ctiid.311104
- https://vuldb.com/?id.311104
- https://vuldb.com/?submit.589117
- https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_admin_edit-team.php_teamid.md
