CVE-2024-0360: Hospital Management System SQL Vulnerability

CVE-2024-0360 Overview

CVE-2024-0360 is a SQL injection vulnerability in PHPGurukul Hospital Management System 1.0. The flaw resides in admin/edit-doctor-specialization.php, where the doctorspecilization parameter is passed directly into a database query without sanitization. Remote attackers can manipulate this argument to inject arbitrary SQL statements and compromise the backend database. The issue is tracked as VDB-250127 and is classified under [CWE-89]. Exploitation details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments.

Critical Impact

Unauthenticated remote attackers can extract, modify, or destroy sensitive patient and administrative data through SQL injection against the admin interface.

Affected Products

• PHPGurukul Hospital Management System 1.0
• Component: admin/edit-doctor-specialization.php
• Parameter: doctorspecilization

Discovery Timeline

• 2024-01-10 - CVE-2024-0360 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0360

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the administrative panel of PHPGurukul Hospital Management System 1.0. The script admin/edit-doctor-specialization.php accepts the doctorspecilization parameter and concatenates it into an SQL UPDATE or SELECT statement without parameterization or input validation.

Because the application performs no escaping or prepared statement binding, attackers can break out of the intended query context. They can then append arbitrary SQL clauses such as UNION SELECT, time-based blind payloads, or stacked statements depending on the underlying MySQL configuration.

Successful exploitation allows full read and write access to the hospital database. This includes patient records, doctor credentials, appointment data, and administrative authentication tables.

Root Cause

The root cause is the unsafe handling of user-supplied input in a database query. The doctorspecilization value is taken directly from the HTTP request and embedded into an SQL string. PHPGurukul's codebase relies on string concatenation rather than mysqli_prepare() or PDO parameterized queries, which is a recurring pattern across PHPGurukul applications.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker submits a crafted HTTP request to the admin/edit-doctor-specialization.php endpoint with a malicious doctorspecilization value. While the endpoint resides in the admin path, the public proof-of-concept indicates the injection point is reachable in vulnerable installations.

The vulnerability mechanism is documented in the public GitHub SQL Injection Document and the VulDB entry #250127.

Detection Methods for CVE-2024-0360

Indicators of Compromise

• HTTP POST or GET requests to /admin/edit-doctor-specialization.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the doctorspecilization parameter.
• Web server access logs showing repeated requests to the endpoint from a single source within a short timeframe.
• Unexpected MySQL errors in PHP error logs referencing edit-doctor-specialization.php.
• Anomalous database queries containing INFORMATION_SCHEMA enumeration against the hospital management database.

Detection Strategies

• Deploy a Web Application Firewall (WAF) rule that inspects the doctorspecilization parameter for SQL injection signatures.
• Enable MySQL general query logging temporarily to identify malformed or chained queries originating from the affected script.
• Review authentication and session logs for unauthorized admin sessions preceding suspicious database activity.

Monitoring Recommendations

• Forward web server and database logs to a centralized log analytics platform for correlation and alerting on injection patterns.
• Alert on outbound data transfers from the database host that exceed normal baselines, which may indicate bulk data exfiltration.
• Monitor for new or modified rows in administrative user tables that were not initiated by legitimate workflows.

How to Mitigate CVE-2024-0360

Immediate Actions Required

• Restrict network access to the /admin/ directory using IP allowlists or VPN-only access until a fix is applied.
• Audit the database for unauthorized modifications, new administrator accounts, and altered doctor or patient records.
• Rotate all administrative credentials and database passwords used by the application.
• Review web server logs from January 2024 onward for exploitation attempts against edit-doctor-specialization.php.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-0360. Operators of PHPGurukul Hospital Management System 1.0 should monitor the vendor's distribution channels for an updated release and consider migrating away from the affected version if no fix is provided. In the interim, apply source-code remediation by replacing string-concatenated SQL in admin/edit-doctor-specialization.php with parameterized queries using mysqli_prepare() or PDO.

Workarounds

• Implement server-side input validation that rejects non-alphanumeric characters in the doctorspecilization field before it reaches the database layer.
• Deploy a WAF with OWASP Core Rule Set enabled to block common SQL injection payloads targeting the affected endpoint.
• Apply the principle of least privilege to the MySQL account used by the application, removing DROP, ALTER, and FILE privileges where not required.
• Disable or remove the edit-doctor-specialization.php script if the doctor specialization edit functionality is not actively used.

# Example: harden MySQL application user privileges
REVOKE ALL PRIVILEGES ON hospital_db.* FROM 'hms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON hospital_db.* TO 'hms_app'@'localhost';
FLUSH PRIVILEGES;