CVE-2024-8470: Phpgurukul Job Portal SQLi Vulnerability

CVE-2024-8470 Overview

CVE-2024-8470 is a SQL injection vulnerability [CWE-89] in PHPGurukul Job Portal 1.0. The flaw resides in the CATEGORY parameter of /jobportal/admin/vacancy/controller.php. An unauthenticated remote attacker can submit a crafted query through this parameter and extract arbitrary data from the backing database.

Critical Impact

Remote attackers without credentials can read all data stored in the Job Portal database, including administrator credentials, applicant records, and vacancy details.

Affected Products

• PHPGurukul Job Portal 1.0
• Deployments exposing /jobportal/admin/vacancy/controller.php
• Installations relying on the default database schema bundled with the application

Discovery Timeline

• 2024-09-05 - CVE-2024-8470 published to the National Vulnerability Database (NVD)
• 2024-09-06 - Last updated in NVD database

Technical Details for CVE-2024-8470

Vulnerability Analysis

The vulnerability exists in the administrative vacancy controller of PHPGurukul Job Portal. The controller.php script accepts a CATEGORY HTTP parameter and concatenates it into a SQL statement without parameterization or input validation. An attacker submitting boolean-based, error-based, or UNION-based payloads can alter the query and exfiltrate database contents.

Because the affected endpoint is exposed over the network and requires no authentication, exploitation is straightforward using automated tools such as sqlmap. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

The scope is limited to confidentiality. The attacker can read database tables, including stored credentials, personal applicant data, and recruiter information. The flaw does not directly permit modification of data or denial of service through this entry point.

Root Cause

The root cause is the absence of prepared statements or input sanitization for the CATEGORY parameter. The application embeds user-supplied input directly into a dynamic SQL string. Standard mitigations such as PDO parameter binding or mysqli_real_escape_string are not applied to this parameter.

Attack Vector

An attacker sends an HTTP request to /jobportal/admin/vacancy/controller.php with a malicious CATEGORY value. The payload terminates the original query and appends a UNION SELECT or similar construct to retrieve arbitrary columns. No prior authentication or user interaction is required.

Verified exploitation details are documented in the INCIBE Security Notice. No public proof-of-concept code is currently catalogued in Exploit-DB.

Detection Methods for CVE-2024-8470

Indicators of Compromise

• HTTP requests to /jobportal/admin/vacancy/controller.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the CATEGORY parameter.
• Web server access logs showing unusually long CATEGORY values or encoded payloads (%27, %20UNION%20).
• Database error messages referencing controller.php in PHP error logs.
• Anomalous outbound responses with large payload sizes returned from the vacancy controller.

Detection Strategies

• Deploy Web Application Firewall (WAF) rules that match common SQL injection signatures against the CATEGORY parameter.
• Enable MySQL general query logging temporarily and review queries originating from vacancy/controller.php for non-numeric CATEGORY values.
• Use static analysis on the PHPGurukul source to identify all sinks where $_GET['CATEGORY'] or $_POST['CATEGORY'] flow into SQL strings.

Monitoring Recommendations

• Alert on repeated 500-series HTTP responses from the /jobportal/admin/ path, which often indicate injection probing.
• Monitor database accounts used by the Job Portal for unexpected information_schema or mysql.user table access.
• Correlate authentication events with subsequent administrative panel access to detect credential theft following data exfiltration.

How to Mitigate CVE-2024-8470

Immediate Actions Required

• Restrict network access to /jobportal/admin/ paths to trusted administrative IP ranges using web server ACLs.
• Place the application behind a WAF with SQL injection signatures enabled in blocking mode.
• Rotate all database credentials and administrator passwords if the portal has been internet-exposed.
• Audit the database for unauthorized read activity originating from the application's MySQL user.

Patch Information

No vendor patch has been published by PHPGurukul at the time of CVE publication. Refer to the INCIBE Security Notice for the official advisory. Operators should monitor the PHPGurukul site for updated releases beyond version 1.0.

Workarounds

• Modify controller.php to cast CATEGORY to an integer with intval($_REQUEST['CATEGORY']) before use in SQL.
• Replace concatenated SQL with PDO prepared statements binding CATEGORY as a typed parameter.
• Apply server-level mod_security rules that drop requests containing SQL keywords in the CATEGORY parameter.
• Consider removing the Job Portal application from production until an upstream fix is available.

# Example ModSecurity rule to block SQLi attempts against the CATEGORY parameter
SecRule ARGS:CATEGORY "@detectSQLi" \
  "id:1008470,phase:2,deny,status:403,\
  msg:'CVE-2024-8470 SQLi attempt on CATEGORY parameter',\
  logdata:'%{MATCHED_VAR}'"