CVE-2021-47956: EgavilanMedia PHPCRUD SQL injection in firstname parameter

Executive brief

EgavilanMedia PHPCRUD is a web application used for managing database records. A security flaw in this software allows an unauthenticated attacker to manipulate database queries by submitting malicious data through the 'firstname' field. This could lead to the unauthorized extraction of sensitive information from the application's database, potentially compromising user data or operational integrity.

Technical details

An SQL injection vulnerability exists in EgavilanMedia PHPCRUD 1.0 due to improper neutralization of special elements in the 'firstname' parameter. The flaw is located in the 'insert.php' component, which processes POST requests for adding new records. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request containing SQL commands. Successful exploitation allows the attacker to manipulate backend database queries, potentially leading to full database dumping or unauthorized data access. The vulnerability has been verified with automated tools like sqlmap.

Affected products

• EgavilanMedia PHPCRUD 1.0

Timeline

• 2021-05-17: disclosed: Initial exploit published on Exploit-DB
• 2026-05-16: advisory: CVE published and NVD record created

References

• https://egavilanmedia.com/
• https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/
• https://www.exploit-db.com/exploits/49878
• https://www.vulncheck.com/advisories/egavilanmedia-phpcrud-sql-injection-via-firstname