CVE-2024-3771: PHPGurukul Student Record SQLi Flaw

CVE-2024-3771 Overview

CVE-2024-3771 is a SQL injection vulnerability in PHPGurukul Student Record System version 3.20. The flaw resides in the /edit-subject.php script, where the sub1, sub2, sub3, sub4, and udate parameters are concatenated into SQL statements without proper sanitization. An authenticated remote attacker can manipulate these arguments to inject arbitrary SQL syntax against the backend database.

The issue is tracked as VulDB identifier VDB-260618 and is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A public exploit is documented in an external GitHub repository.

Critical Impact
Successful exploitation allows attackers to read, modify, or delete student records and potentially achieve full database compromise through the vulnerable edit-subject.php endpoint.

Affected Products

PHPGurukul Student Record System 3.20
CPE: cpe:2.3:a:phpgurukul:student_record_system:3.20:*:*:*:*:*:*:*
Vulnerable component: phpgurukul:student_record_system

Discovery Timeline

2024-04-15 - CVE-2024-3771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3771

Vulnerability Analysis

The vulnerability is a classic first-order SQL injection in the subject-editing workflow of the Student Record System. When an authenticated user submits the edit-subject form, the application passes user-controlled values for sub1, sub2, sub3, sub4, and udate directly into a SQL UPDATE statement. Because these inputs are not parameterized or escaped, attackers can break out of the intended query context and append their own SQL clauses.

The attack requires network access and low-privilege authentication but no user interaction. Impact spans confidentiality, integrity, and availability, since injected queries can read arbitrary tables, alter records, or drop data. A public proof-of-concept is published in the BurakSevben CVE repository on GitHub.

Root Cause

The root cause is improper neutralization of special SQL characters in edit-subject.php. The PHP source concatenates POST parameters into the SQL string rather than using prepared statements with bound parameters. Any single quote, comment sequence, or SQL keyword supplied by the user is interpreted as query syntax by the MySQL backend.

Attack Vector

An authenticated attacker sends a crafted POST request to /edit-subject.php with malicious payloads in one or more of the five vulnerable parameters. Payloads such as boolean-based, union-based, or time-based SQL injection strings can extract records from the students, admin, or subject tables. Because the vulnerable route is reachable over the network, exploitation can occur from any workstation with access to the application.

No verified sanitized exploit code is available for republication. Refer to the public proof-of-concept for the exact request format.

Detection Methods for CVE-2024-3771

Indicators of Compromise

POST requests to /edit-subject.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the sub1, sub2, sub3, sub4, or udate fields.
Web server access logs showing abnormally long request bodies or repeated edit-subject submissions from a single session.
MySQL error log entries referencing syntax errors on UPDATE statements against the subject table.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects POST bodies to edit-subject.php for SQL injection signatures.
Enable database query logging and alert on UPDATE statements containing stacked queries or UNION SELECT targeting authentication tables.
Correlate authenticated session identifiers with anomalous parameter payload lengths against edit-subject.php.

Monitoring Recommendations

Baseline normal parameter values for the five vulnerable fields and alert on deviations.
Monitor for outbound data spikes from the database host, which may indicate mass extraction via UNION-based injection.
Track failed login attempts followed by successful edit-subject requests, which may indicate account compromise chained with exploitation.

How to Mitigate CVE-2024-3771

Immediate Actions Required

Restrict access to the Student Record System application to trusted internal networks or a VPN until a fix is applied.
Audit administrator and staff accounts and rotate credentials that could be used to reach edit-subject.php.
Review database and web server logs for evidence of prior exploitation attempts against the affected endpoint.

Patch Information

No vendor patch has been referenced in the NVD entry for CVE-2024-3771. Organizations running PHPGurukul Student Record System 3.20 should monitor the PHPGurukul website for updated releases and consider replacing the application if an official fix is not published. Additional advisory context is available at VulDB entry 260618.

Workarounds

Place a WAF in front of the application with rules blocking SQL metacharacters in the sub1, sub2, sub3, sub4, and udate POST parameters.
Apply a source-level hotfix by converting the UPDATE statement in edit-subject.php to a prepared statement using mysqli_prepare or PDO with bound parameters.
Enforce least-privilege database accounts so the application user cannot read authentication tables or execute administrative SQL.
Disable the edit-subject function for non-administrator roles if the workflow is not business-critical.

bash

# Example: block requests containing common SQLi patterns targeting the vulnerable endpoint (ModSecurity)
SecRule REQUEST_URI "@streq /edit-subject.php" \
  "phase:2,chain,deny,status:403,id:1002024,\
   msg:'Possible CVE-2024-3771 SQL injection attempt'"
  SecRule ARGS:sub1|ARGS:sub2|ARGS:sub3|ARGS:sub4|ARGS:udate \
    "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|'\s*or\s*'?1'?='?1)" \
    "t:none,t:urlDecodeUni"