CVE-2024-0361: Hospital Management System SQLi Vulnerability

CVE-2024-0361 Overview

CVE-2024-0361 is a SQL injection vulnerability in PHPGurukul Hospital Management System 1.0. The flaw resides in the admin/contact.php file, where the mobnum parameter is passed to a backend SQL query without proper sanitization. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is tracked as VDB-250128 and is classified under CWE-89. Public disclosure of the exploit details has occurred, increasing the risk of opportunistic attacks against exposed deployments.

Critical Impact
Unauthenticated attackers can extract, modify, or destroy sensitive patient and administrative data stored in the application database through crafted HTTP requests.

Affected Products

PHPGurukul Hospital Management System 1.0
Deployments using the vulnerable admin/contact.php endpoint
Web servers hosting unpatched instances of the application

Discovery Timeline

2024-01-10 - CVE-2024-0361 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0361

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the administrative contact handler. The admin/contact.php script accepts user-controlled input via the mobnum argument and concatenates it directly into a SQL query. Because the input is neither validated nor parameterized, attackers can break out of the intended query context. Successful exploitation allows full read and write access to the underlying database. Given the application's purpose, the exposed data typically includes patient records, login credentials, and appointment information.

The attack requires no authentication and no user interaction. An attacker only needs network reachability to the vulnerable endpoint. Exploit details have been published, which lowers the barrier to weaponization.

Root Cause

The root cause is improper neutralization of special characters within a SQL statement. The application builds queries through string concatenation using the mobnum request parameter. There is no use of prepared statements, parameter binding, or input sanitization routines. Any single-quote or SQL keyword supplied by the attacker is interpreted as query syntax rather than data.

Attack Vector

The attack vector is network-based and targets the admin/contact.php endpoint over HTTP or HTTPS. An attacker submits a request containing a crafted mobnum value such as a payload using UNION SELECT statements or boolean-based blind injection patterns. The injected SQL is executed with the privileges of the application's database user. Refer to the public proof-of-concept documentation for technical reproduction details.

No verified exploit code is reproduced here. See the VulDB entry for VDB-250128 for additional context.

Detection Methods for CVE-2024-0361

Indicators of Compromise

HTTP POST or GET requests to admin/contact.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the mobnum parameter
Web server access logs showing unusually long or URL-encoded payloads targeting the mobnum field
Database error messages referencing mobnum or syntax errors logged by the PHP application
Unexpected outbound queries or data export activity from the database server

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns against the admin/contact.php URI
Inspect application and database logs for query anomalies originating from the contact submission flow
Apply runtime monitoring on the database to detect statements that deviate from the application's known query templates

Monitoring Recommendations

Alert on repeated 500-level HTTP responses from admin/contact.php, which often indicate failed injection attempts
Monitor for new administrative accounts or modified privilege tables in the Hospital Management System database
Track egress traffic from the web server for signs of database exfiltration over HTTP or DNS

How to Mitigate CVE-2024-0361

Immediate Actions Required

Restrict network access to admin/contact.php to trusted administrative networks until a fix is applied
Place the application behind a WAF configured to block SQL injection payloads targeting the mobnum parameter
Audit the database for unauthorized accounts, data modifications, or evidence of prior exploitation
Rotate database credentials and application secrets if compromise is suspected

Patch Information

No vendor-supplied patch is referenced in the NVD entry for CVE-2024-0361. Operators should monitor the PHPGurukul project page for an updated release of Hospital Management System and apply it as soon as it becomes available. In the interim, code-level remediation should replace string-concatenated queries in admin/contact.php with parameterized statements using PDO or MySQLi prepared statements.

Workarounds

Modify admin/contact.php to validate mobnum against a strict numeric regular expression before any database interaction
Replace dynamic SQL with prepared statements that bind mobnum as a typed parameter
Apply least-privilege database accounts so the web application cannot execute administrative SQL statements
Disable the contact module entirely if it is not required in the deployment

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/contact.php" \
  "phase:2,chain,deny,status:403,id:1000361,msg:'CVE-2024-0361 SQLi attempt on mobnum'"
  SecRule ARGS:mobnum "@rx (?i)(union(.*?)select|sleep\(|--|';|/\*)" \
    "t:none,t:urlDecodeUni"