Executive brief
PHPGurukul User Registration & Login and User Management System is a web application used for managing user accounts and administrative tasks. A security vulnerability in the administrative panel allows an attacker to interfere with the application's database. If exploited, this could lead to unauthorized access to sensitive user information, data modification, or disruption of the management system.
Technical details
A SQL injection vulnerability exists in PHPGurukul User Registration & Login and User Management System 3.3 within the '/admin/yesterday-reg-users.php' component. The root cause is the failure to sanitize or validate the 'id' GET parameter before using it in a database query. An authenticated attacker with access to the admin panel can exploit this via a crafted network request to execute arbitrary SQL commands. This can lead to time-based blind SQL injection, allowing for the extraction of database contents or unauthorized data manipulation. A public proof-of-concept (PoC) using time-based blind techniques (RLIKE SLEEP) has been disclosed.
Affected products
- PHPGurukul User Registration & Login and User Management System 3.3
Timeline
- 2026-03-18: disclosed: Initial discovery and PoC shared on GitHub
- 2026-04-05: advisory: CVE published and VulDB entry created