CVE-2024-5360: Zoo Management System SQL Injection Flaw

CVE-2024-5360 Overview

CVE-2024-5360 is a SQL injection vulnerability in PHPGurukul Zoo Management System 2.1. The flaw resides in the /admin/foreigner-bwdates-reports-details.php script, where the fromdate parameter is passed into a database query without proper sanitization. Attackers can exploit the issue remotely over the network with low-privilege authenticated access. Public disclosure of the exploit increases the likelihood of opportunistic scanning and abuse against exposed instances. The weakness is tracked as CWE-89 and indexed in VulDB as entry 266272.

Critical Impact

Authenticated attackers can manipulate backend SQL queries to read, modify, or destroy data within the Zoo Management System database.

Affected Products

• PHPGurukul Zoo Management System 2.1
• Component: /admin/foreigner-bwdates-reports-details.php
• Vulnerable parameter: fromdate

Discovery Timeline

• 2024-05-26 - CVE-2024-5360 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-5360

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the administrative reporting module of PHPGurukul Zoo Management System 2.1. The foreigner-bwdates-reports-details.php script accepts a fromdate value from an HTTP request and concatenates it directly into a SQL statement used to filter foreigner visitor reports by date range.

Because the application does not use parameterized queries or input validation on fromdate, an attacker can break out of the intended string context. Crafted payloads can append UNION SELECT statements, boolean conditions, or stacked queries depending on the underlying MySQL configuration. Successful exploitation exposes administrative data, including authentication credentials stored in the database.

The issue is reachable remotely. The attacker must possess low-privilege access to the admin interface, but credential reuse and weak default deployments make this barrier limited in practice.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The fromdate parameter is incorporated into the query string without prepared statements, bound parameters, or type-casting to a date format. PHP code paths that build queries through string concatenation propagate untrusted input directly to the MySQL backend.

Attack Vector

Exploitation occurs over HTTP against the admin endpoint /admin/foreigner-bwdates-reports-details.php. An attacker submits a POST or GET request where the fromdate field contains SQL metacharacters such as single quotes, comments, and UNION clauses. The injected payload executes within the database context of the application user, returning data in the rendered report page or via blind boolean and time-based techniques. Technical details and proof-of-concept references are available at the VulDB entry 266272 and the Yuque security writeup.

Detection Methods for CVE-2024-5360

Indicators of Compromise

• HTTP requests to /admin/foreigner-bwdates-reports-details.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA in the fromdate parameter.
• Web server access logs showing unusually long query strings or repeated requests to the foreigner reports endpoint from a single source.
• Database error messages referencing syntax errors near fromdate values returned in HTTP responses.

Detection Strategies

• Deploy web application firewall rules that inspect the fromdate parameter against the endpoint and block payloads matching common SQLi signatures.
• Enable MySQL general query logging during incident response to correlate suspicious admin requests with unexpected query structures.
• Hunt for anomalous response sizes on the reports endpoint, which can indicate UNION-based data extraction.

Monitoring Recommendations

• Forward web server and database logs to a centralized analytics platform and alert on SQL keywords appearing in date-typed fields.
• Monitor for new or unusual admin session creation immediately followed by access to reporting modules.
• Track outbound traffic from the web server host, since attackers often chain SQLi with file write primitives to stage secondary payloads.

How to Mitigate CVE-2024-5360

Immediate Actions Required

• Restrict access to the /admin/ directory to trusted IP ranges or place the application behind a VPN until a patched build is available.
• Rotate all administrator credentials and any database account passwords reachable from the application.
• Audit the tblforeignertrack and user tables for unauthorized rows or modifications.

Patch Information

No vendor patch is currently referenced in the NVD or VulDB advisories for PHPGurukul Zoo Management System 2.1. Operators should monitor the PHPGurukul project page for updated releases and apply fixes as soon as they are published. Until then, source-level remediation requires rewriting the affected query to use mysqli_prepare with bound parameters and validating that fromdate conforms to a strict date format.

Workarounds

• Implement a server-side filter that rejects any fromdate value not matching the regular expression ^\d{4}-\d{2}-\d{2}$ before the value reaches the query.
• Place a WAF rule in front of the application that blocks SQL keywords in the fromdate parameter for the affected URL.
• Apply database least-privilege by restricting the web application's MySQL account to read-only access on the reporting tables where feasible.

# Example ModSecurity rule to block SQLi attempts against the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/foreigner-bwdates-reports-details.php" \
    "chain,phase:2,deny,status:403,id:1005360,msg:'CVE-2024-5360 SQLi attempt on fromdate'"
    SecRule ARGS:fromdate "!@rx ^\d{4}-\d{2}-\d{2}$" "t:none"