CVE-2024-8465: Phpgurukul Job Portal SQLi Vulnerability

CVE-2024-8465 Overview

CVE-2024-8465 is a SQL injection vulnerability in PHPGurukul Job Portal 1.0. The flaw exists in the user_id parameter of /jobportal/admin/user/controller.php. An unauthenticated attacker can send a crafted query through this parameter to extract data from the backend database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can exfiltrate the entire contents of the Job Portal database, including administrator credentials and applicant personal data.

Affected Products

• PHPGurukul Job Portal 1.0
• Component: /jobportal/admin/user/controller.php
• CPE: cpe:2.3:a:phpgurukul:job_portal:1.0:*:*:*:*:*:*:*

Discovery Timeline

• 2024-09-05 - CVE-2024-8465 published to NVD
• 2024-09-06 - Last updated in NVD database

Technical Details for CVE-2024-8465

Vulnerability Analysis

The vulnerability resides in the administrative user controller script of PHPGurukul Job Portal 1.0. The script accepts a user_id request parameter and concatenates it into an SQL statement without parameterization or input validation. An attacker supplies SQL syntax through this parameter, altering the query logic executed by the database server.

Because the endpoint is reachable over the network and requires no authentication, exploitation can be automated using common tooling. Successful exploitation enables retrieval of arbitrary data stored in the application database. According to the CVSS vector, confidentiality is fully impacted while integrity and availability remain unaffected by this specific injection path.

The EPSS probability for this CVE stands at approximately 0.118%, placing it in the 30th percentile of CVEs by observed exploitation likelihood.

Root Cause

The root cause is unsanitized user-controlled input concatenated directly into an SQL query string. The user_id parameter is not bound as a prepared statement parameter and is not validated against an expected data type or range. This allows attacker-supplied SQL fragments to be interpreted as code by the database engine.

Attack Vector

The attack vector is network-based. An attacker issues an HTTP request to /jobportal/admin/user/controller.php with a malicious payload in the user_id parameter. Typical exploitation patterns include UNION-based extraction, boolean-based blind injection, and time-based blind injection to enumerate schema details and dump records.

No verified proof-of-concept code is published in the referenced advisory. Technical details are summarized by the INCIBE Notice on Job Portal Vulnerabilities.

Detection Methods for CVE-2024-8465

Indicators of Compromise

• HTTP requests to /jobportal/admin/user/controller.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the user_id parameter.
• Web server access logs showing high-volume, automated requests to the controller endpoint from a single source.
• Database error messages referencing syntax errors near user_id values appearing in PHP error logs.
• Unusually large response bodies from the controller endpoint, indicating bulk data extraction.

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the user_id parameter.
• Inspect database query logs for non-integer values being passed where a numeric user_id is expected.
• Alert on response time anomalies for the controller endpoint, which can indicate time-based blind SQL injection attempts.

Monitoring Recommendations

• Forward web server, PHP, and MySQL logs to a centralized analytics platform for correlation across request, application, and database tiers.
• Establish a baseline of normal administrator activity against /jobportal/admin/ paths and alert on deviations.
• Monitor outbound network traffic from the database host for unusual data egress patterns that may indicate successful exfiltration.

How to Mitigate CVE-2024-8465

Immediate Actions Required

• Restrict access to /jobportal/admin/ paths to trusted administrator IP ranges using web server access controls.
• Deploy WAF rules that block SQL metacharacters in the user_id parameter until code-level remediation is applied.
• Rotate database credentials and administrator passwords if exploitation is suspected.
• Audit the application database for unauthorized accounts and unexpected schema modifications.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-8465 at the time of publication. Operators should monitor PHPGurukul for updated releases. Refer to the INCIBE advisory for the current disclosure status.

Workarounds

• Modify controller.php to use parameterized queries via PDO or mysqli prepared statements instead of string concatenation.
• Cast the user_id parameter to an integer with intval() before any database interaction, as the value is expected to be numeric.
• Place the Job Portal application behind a reverse proxy that enforces strict input validation on query and POST parameters.
• If the application is not in active use, take it offline until a fix is available.

# Example PHP remediation pattern using PDO prepared statements
# Replace vulnerable concatenation in controller.php
$user_id = filter_input(INPUT_GET, 'user_id', FILTER_VALIDATE_INT);
if ($user_id === false || $user_id === null) {
    http_response_code(400);
    exit('Invalid user_id');
}
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :uid');
$stmt->bindValue(':uid', $user_id, PDO::PARAM_INT);
$stmt->execute();