CVE-2024-5358: Zoo Management System SQL Injection Flaw

CVE-2024-5358 Overview

CVE-2024-5358 is a SQL injection vulnerability in PHPGurukul Zoo Management System 2.1. The flaw resides in the /admin/normal-search.php endpoint, where the searchdata parameter is passed into a database query without proper sanitization. An authenticated remote attacker with low privileges can manipulate the parameter to alter SQL statement logic. The vulnerability is tracked as VulDB identifier VDB-266270 and maps to [CWE-89]. Public disclosure of exploitation details has occurred, increasing the likelihood of opportunistic attacks against exposed installations.

Critical Impact

Remote attackers can manipulate the searchdata parameter to inject SQL statements, allowing unauthorized read or modification of administrative records in the zoo management database.

Affected Products

• PHPGurukul Zoo Management System 2.1
• The /admin/normal-search.php script
• Deployments exposing the admin interface to untrusted networks

Discovery Timeline

• 2024-05-26 - CVE-2024-5358 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-5358

Vulnerability Analysis

The vulnerability is a classic SQL injection in the administrative search functionality of PHPGurukul Zoo Management System 2.1. The /admin/normal-search.php script accepts user-supplied input through the searchdata parameter and concatenates that input directly into a SQL query. Because the application performs no parameterization or input sanitization, attacker-controlled characters break out of the intended string context. The result is attacker-controlled SQL execution within the application's database session.

Exploitation requires network access to the admin interface and a valid low-privileged session. Once authenticated, an attacker submits crafted search input to extract data from arbitrary tables, including credential hashes and operational records. The exploit has been publicly disclosed, lowering the technical barrier for adversaries.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The searchdata parameter is interpolated into a query string rather than passed as a bound parameter. Standard MySQL metacharacters such as single quotes, UNION keywords, and comment sequences pass through unfiltered into the query parser.

Attack Vector

The attack vector is network-based and requires authentication to the admin panel. An attacker submits a POST or GET request to /admin/normal-search.php with a malicious payload in the searchdata field. Typical payloads use UNION SELECT clauses to retrieve data from other tables or boolean-based blind techniques to enumerate database contents row by row. Refer to the VulDB advisory and YuQue Security Analysis for proof-of-concept payload details.

Detection Methods for CVE-2024-5358

Indicators of Compromise

• HTTP requests to /admin/normal-search.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the searchdata parameter.
• Web server access logs showing repeated requests to the search endpoint from a single source within short time windows.
• Database error messages or unexpected response sizes returned from the admin search functionality.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect the searchdata parameter for SQL injection signatures.
• Enable database query logging and alert on queries originating from the admin search context that reference tables outside the expected schema.
• Correlate authentication events with anomalous search activity to identify abuse of legitimate admin sessions.

Monitoring Recommendations

• Monitor outbound database connections for unusual data volumes following admin login events.
• Track HTTP 500 responses from /admin/normal-search.php, which often indicate failed injection attempts.
• Review admin account activity for logins from unexpected geographic locations or IP ranges.

How to Mitigate CVE-2024-5358

Immediate Actions Required

• Restrict access to the /admin/ directory using IP allowlisting or VPN-only access until a patch is available.
• Rotate all administrative credentials and audit database accounts used by the application.
• Review web server and database logs for prior exploitation indicators referencing the searchdata parameter.

Patch Information

No vendor patch has been published for PHPGurukul Zoo Management System 2.1 at the time of NVD listing. Organizations running this application should track the PHPGurukul project for security updates and consider migrating off the affected version.

Workarounds

• Apply a WAF rule to block requests to /admin/normal-search.php containing SQL metacharacters in the searchdata parameter.
• Modify the source of normal-search.php to use parameterized queries with mysqli_prepare() or PDO prepared statements.
• Implement server-side input validation that rejects non-alphanumeric characters from the search field.
• Disable or remove the vulnerable search functionality if it is not operationally required.

# Example ModSecurity rule to block SQLi patterns in searchdata
SecRule ARGS:searchdata "@rx (?i)(union(.*?)select|sleep\(|--|';|/\*)" \
  "id:1005358,phase:2,deny,status:403,\
  msg:'CVE-2024-5358 SQL injection attempt against PHPGurukul Zoo Management'"