CVE-2024-10301: Phpgurukul Medical Card System SQL Injection

CVE-2024-10301 Overview

CVE-2024-10301 is a SQL injection vulnerability in PHPGurukul Medical Card Generation System 1.0. The flaw resides in the /admin/search-medicalcard.php file within the Search component. Attackers can manipulate the searchdata parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires authenticated administrative access, per the CVSS 4.0 vector. Public disclosure of the exploit technique means unpatched deployments face active risk. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated attacker can inject SQL into the searchdata parameter to read, modify, or delete database records containing patient medical card information.

Affected Products

PHPGurukul Medical Card Generation System 1.0
Component: /admin/search-medicalcard.php (Search functionality)
Vulnerable parameter: searchdata

Discovery Timeline

2024-10-23 - CVE-2024-10301 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10301

Vulnerability Analysis

The vulnerability originates in the administrative search functionality of the Medical Card Generation System. The search-medicalcard.php script accepts user-supplied input via the searchdata parameter and concatenates it directly into a SQL query. No input sanitization or parameterized query mechanism is applied before the value reaches the database engine.

An authenticated administrator submitting a crafted searchdata value can alter query logic. This enables extraction of records from the underlying MySQL database, including patient identifiers and stored credentials. Depending on database privileges, attackers may also modify or drop tables.

The attack requires network access to the administrative interface and valid administrative credentials. Public exploit details reduce the technical barrier for weaponization.

Root Cause

The root cause is failure to neutralize special SQL characters in the searchdata request parameter [CWE-89]. The application builds queries through direct string concatenation instead of using prepared statements with bound parameters. Any single quote, comment marker, or SQL keyword supplied by the user is interpreted as query syntax by the backend.

Attack Vector

Exploitation targets the HTTP request handler for the search feature. An authenticated attacker submits a POST or GET request to /admin/search-medicalcard.php with a payload placed in searchdata. Typical payloads use UNION SELECT statements to exfiltrate data from other tables, or boolean-based inference to enumerate records one character at a time. Automated tools such as sqlmap can identify and exploit the flaw directly against the vulnerable endpoint.

No verified exploit code is published in a controlled repository. The vulnerability was disclosed through VulDB submission VulDB #281568. Technical details are described in prose rather than reproduced here.

Detection Methods for CVE-2024-10301

Indicators of Compromise

HTTP requests to /admin/search-medicalcard.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the searchdata parameter.
Unusually long or URL-encoded values in the searchdata field observed in web server access logs.
MySQL error messages logged by PHP referencing search-medicalcard.php as the calling script.
Unexpected outbound database queries against tables unrelated to medical card searches.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the searchdata parameter on the admin path.
Enable MySQL general query logging temporarily to correlate anomalous queries with authenticated admin sessions.
Ingest web server and database logs into a SIEM and alert on SQL error codes tied to the admin search endpoint.

Monitoring Recommendations

Monitor authentication logs for admin account logins from unexpected IP addresses preceding search activity.
Track query volume and response sizes for /admin/search-medicalcard.php to detect bulk data extraction.
Review database audit logs for INFORMATION_SCHEMA access originating from the web application user.

How to Mitigate CVE-2024-10301

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlists or VPN-gated access until a patch is applied.
Rotate all administrator credentials and enforce strong password policies to reduce the risk of the authenticated prerequisite being met.
Deploy WAF rules that block SQL metacharacters submitted to the searchdata parameter.
Audit the MySQL account used by the application and remove privileges beyond those required for card generation.

Patch Information

No official vendor patch is listed in the NVD advisory or on the PHP Gurukul website at the time of publication. Operators should monitor vendor channels for updates. If no patch is issued, source-level remediation requires replacing string-concatenated queries in search-medicalcard.php with prepared statements using mysqli::prepare() or PDO parameter binding.

Workarounds

Apply server-side input validation that rejects any searchdata value containing non-alphanumeric characters.
Configure the database user with read-only access to only the specific tables required by the search feature.
Place the application behind a reverse proxy that inspects and normalizes request parameters.
Consider migrating off Medical Card Generation System 1.0 to a maintained alternative if no vendor fix appears.

bash

# Example WAF rule (ModSecurity) blocking SQLi in searchdata
SecRule ARGS:searchdata "@detectSQLi" \
    "id:1010301,phase:2,deny,status:403,\
    msg:'CVE-2024-10301 SQLi attempt on searchdata',\
    logdata:'Matched: %{MATCHED_VAR}'"