CVE-2025-5663
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Auto Taxi Stand Management System 1.0 allows attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-autoortaxi.php. Attackers can remotely exploit this to access, modify, or delete database content. All installations of version 1.0 are affected.
💻 Affected Systems
- PHPGurukul Auto Taxi Stand Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, privilege escalation, and potential data manipulation affecting taxi stand operations and customer information.
If Mitigated
Limited impact with proper input validation, WAF protection, and database permissions restricting damage to specific tables.
🎯 Exploit Status
Exploit requires admin access; SQL injection is straightforward with publicly available proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in /admin/search-autoortaxi.php.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize searchdata parameter before SQL processing
Modify /admin/search-autoortaxi.php to implement mysqli_real_escape_string() or prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting searchdata parameter
Add WAF rule: Block requests with SQL keywords in searchdata parameter
🧯 If You Can't Patch
- Restrict admin panel access to trusted IP addresses only
- Disable or remove /admin/search-autoortaxi.php if functionality is not required
🔍 How to Verify
Check if Vulnerable:
Test searchdata parameter with SQL injection payloads like ' OR '1'='1 in admin panel searchCheck Version:
Check system version in admin panel or readme filesVerify Fix Applied:
Verify parameterized queries are implemented and test with SQL injection payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Requests to /admin/search-autoortaxi.php with SQL keywords
Network Indicators:
- HTTP POST requests to search-autoortaxi.php with suspicious parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/search-autoortaxi.php" AND (param="searchdata" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|--|#|/*)")