CVE-2024-10299: Medical Card Generation System SQLi Flaw

CVE-2024-10299 Overview

CVE-2024-10299 is a SQL injection vulnerability in PHPGurukul Medical Card Generation System 1.0. The flaw resides in /admin/view-card-detail.php, part of the Managecard View Detail Page component. Attackers manipulate the viewid parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable over the network and requires authenticated administrative access. Public disclosure has occurred, increasing the risk of opportunistic exploitation against exposed instances. The weakness maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can inject SQL statements through the viewid parameter to read, modify, or delete medical card records stored in the backend database.

Affected Products

PHPGurukul Medical Card Generation System 1.0
Component: /admin/view-card-detail.php (Managecard View Detail Page)
Vulnerable parameter: viewid

Discovery Timeline

2024-10-23 - CVE-2024-10299 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10299

Vulnerability Analysis

The vulnerability exists in the administrative interface of PHPGurukul Medical Card Generation System 1.0. The view-card-detail.php script accepts a viewid request parameter and passes it into a SQL query without proper sanitization or parameterization. Attackers append SQL syntax to viewid to alter query logic, extract database contents, or manipulate stored records. The attack requires network access to the admin interface and high privileges based on the CVSS 4.0 vector. Public exploit details have been disclosed through VulDB entry 281566.

Root Cause

The root cause is missing input validation and lack of prepared statements when handling the viewid GET parameter. User-supplied input is concatenated directly into a SQL query string sent to the backend. This violates secure coding practices for database access and enables classic SQL injection [CWE-89]. PHPGurukul applications commonly assemble queries through raw string concatenation, which is the underlying design flaw exploited here.

Attack Vector

An authenticated administrator or attacker who has obtained admin credentials sends a crafted HTTP request to /admin/view-card-detail.php?viewid=<payload>. The payload contains SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based blind injection patterns. The server executes the manipulated query and returns data or performs actions determined by the attacker. Because access requires admin privileges, credential theft or brute-force against weak admin passwords is a common precursor. Refer to the VulDB advisory for further technical context.

Detection Methods for CVE-2024-10299

Indicators of Compromise

HTTP requests to /admin/view-card-detail.php containing SQL metacharacters in the viewid parameter such as ', --, UNION, SELECT, or SLEEP(.
Unusual database query patterns or errors originating from the Medical Card Generation System backend.
Unexpected changes to medical card records or new administrative accounts appearing in the application.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the viewid parameter for SQL injection signatures.
Enable database query logging and alert on queries containing tautologies (OR 1=1), stacked statements, or UNION-based extraction patterns.
Correlate admin session activity with anomalous request volumes to view-card-detail.php in web server logs.

Monitoring Recommendations

Forward Apache or Nginx access logs to a centralized logging platform and search for viewid= requests containing encoded SQL syntax.
Monitor authentication logs for failed and successful admin logins that precede requests to the vulnerable endpoint.
Alert on outbound database errors returned to clients, which often indicate active SQL injection probing.

How to Mitigate CVE-2024-10299

Immediate Actions Required

Restrict access to /admin/ paths using IP allowlists, VPN, or reverse proxy authentication until a patch is available.
Rotate all administrative credentials and enforce strong password policies for the admin panel.
Deploy WAF signatures that block SQL injection payloads targeting the viewid parameter.
Audit database contents and logs for signs of unauthorized modification or data extraction.

Patch Information

No vendor patch has been published for PHPGurukul Medical Card Generation System 1.0 in the referenced advisories. Consult the PHP Gurukul website for updates. Where no fix is available, replace the vulnerable script with a version that uses parameterized queries via PDO or MySQLi prepared statements.

Workarounds

Modify view-card-detail.php to cast viewid to an integer before use, for example $viewid = intval($_GET['viewid']);.
Replace direct query concatenation with prepared statements using bound parameters.
Disable or remove the Managecard View Detail Page functionality if it is not required for operations.

bash

# Example: enforce integer casting and prepared statements in PHP
# Original vulnerable pattern (do not use):
#   $viewid = $_GET['viewid'];
#   $sql = "SELECT * FROM tblmedicalcard WHERE id='$viewid'";

# Hardened pattern:
$viewid = filter_input(INPUT_GET, 'viewid', FILTER_VALIDATE_INT);
if ($viewid === false) { http_response_code(400); exit; }
$stmt = $conn->prepare("SELECT * FROM tblmedicalcard WHERE id = ?");
$stmt->bind_param("i", $viewid);
$stmt->execute();