PHPGurukul Pre-School Enrollment System SQL Injection Vulnerability in visit.php

A critical SQL injection vulnerability has been identified in the PHPGurukul Pre-School Enrollment System version 1.0. The issue resides in the visit.php file, where the gname parameter is manipulated to inject malicious SQL code. This exploitation occurs without proper input validation or sanitization, allowing attackers to interfere with SQL queries and execute unauthorized database operations. The vulnerability can be exploited remotely, without any authentication requirements.

Impact

Exploitation of this vulnerability allows attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data manipulation or deletion, and exposure of sensitive information. Such actions could disrupt normal system operations and cause significant harm to the affected organization.

Reproduction

To reproduce this vulnerability, send a POST request to the /preschool/visit.php endpoint. Include the gname parameter with a payload that exploits the SQL injection, such as one that uses SQL injection techniques like 'OR' conditions or SQL functions. The request can be made using a tool like Burp Suite, which can intercept and modify HTTP requests.

Remediation

It is recommended to use prepared statements and parameter binding to prevent SQL injection attacks. Additionally, input validation and filtering should be implemented to ensure that user input meets expected formats and does not contain malicious content. Finally, database user permissions should be minimized to limit access rights to only what is necessary.