CVE-2024-3690: PHPGurukul Small CRM SQL Injection Flaw

CVE-2024-3690 Overview

CVE-2024-3690 is a SQL injection vulnerability in PHPGurukul Small CRM 3.0. The flaw resides in the Change Password Handler component and allows an authenticated attacker to inject malicious SQL statements through unsanitized input. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is tracked in VulDB as entry #260479 and maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote authenticated attackers can inject arbitrary SQL queries through the password change functionality, leading to full compromise of the CRM database including credentials, customer records, and business data.

Affected Products

• PHPGurukul Small CRM 3.0
• Deployments exposing the Change Password Handler to authenticated users
• Web applications sharing the same vulnerable database backend

Discovery Timeline

• 2024-04-12 - CVE-2024-3690 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3690

Vulnerability Analysis

The vulnerability affects the Change Password Handler in PHPGurukul Small CRM 3.0. The handler processes user-supplied input without proper sanitization or the use of parameterized queries. An authenticated attacker can send a crafted request containing SQL metacharacters to the password change endpoint. The injected payload alters the intended SQL statement executed by the backend database.

Successful exploitation allows attackers to read, modify, or delete arbitrary database records. This includes user credentials, session tokens, and sensitive customer relationship data stored by the CRM. The attack requires low privileges and can be launched over the network without user interaction.

Root Cause

The root cause is direct concatenation of user-supplied input into SQL statements within the Change Password Handler. The application fails to enforce input validation, parameterized queries, or prepared statements. This is a classic [CWE-89] weakness where the boundary between code and data is not preserved when constructing queries.

Attack Vector

Exploitation requires an authenticated session on the target Small CRM instance. The attacker submits a modified password change request containing SQL injection payloads in the vulnerable parameter. Because the vulnerability is remotely reachable through the web interface, any low-privileged CRM user account is sufficient to trigger the flaw.

A public proof-of-concept is referenced in the GitHub CVE-2024 PoC Repository. Technical details are also catalogued at VulDB #260479. Refer to these sources for reproduction steps and payload structure.

Detection Methods for CVE-2024-3690

Indicators of Compromise

• Unexpected UNION, SELECT, SLEEP, or -- sequences in POST parameters sent to password change endpoints
• Database error messages returned in HTTP responses tied to the change password workflow
• Anomalous outbound queries from the CRM database process, such as bulk reads of user or credential tables
• Sudden creation, modification, or deletion of administrator accounts within Small CRM

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect password change requests for SQL injection signatures
• Enable verbose logging on the CRM's database driver to capture parameterized query violations and syntax errors
• Correlate authentication events with subsequent password change requests to spot low-privilege accounts issuing malformed input

Monitoring Recommendations

• Monitor HTTP request logs for injection patterns targeting changepassword.php or equivalent handler routes
• Alert on repeated HTTP 500 responses from the CRM tied to database exceptions
• Track database query duration and volume to identify time-based blind SQL injection attempts

How to Mitigate CVE-2024-3690

Immediate Actions Required

• Restrict network access to the Small CRM application to trusted users and IP ranges until a fix is applied
• Rotate all CRM user credentials and database service account passwords to invalidate any data exfiltrated through prior exploitation
• Review database audit logs for signs of unauthorized reads or writes originating from the change password endpoint

Patch Information

No vendor advisory or official patch has been published in the referenced sources at the time of writing. Consult PHPGurukul directly for updated releases and monitor the VulDB entry for advisory updates. Upgrade to any newer maintained CRM version that replaces the vulnerable Change Password Handler with parameterized queries.

Workarounds

• Place the CRM behind a WAF with SQL injection signatures tuned for the change password route
• Apply a virtual patch that rejects requests containing SQL metacharacters in password change parameters
• Enforce least-privilege on the database account used by the CRM so injected queries cannot access unrelated schemas
• Disable the change password functionality at the web server level if it is not required in your deployment

# Example nginx location block to block SQL metacharacters on the change password route
location ~* /changepassword\.php$ {
    if ($args ~* "(union|select|sleep|benchmark|--|;)") {
        return 403;
    }
    proxy_pass http://smallcrm_backend;
}