Executive brief
PHPGurukul Online Course Registration is a web application used to manage student enrollments and course data. A security vulnerability in the system allows remote attackers to interfere with the underlying database without needing a username or password. This could lead to the theft of sensitive student information, unauthorized modification of records, or disruption of the registration service.
Technical details
A SQL injection vulnerability exists in PHPGurukul Online Course Registration 3.1 within the '/check_availability.php' file. The root cause is the failure to sanitize or validate user-supplied input for the 'cid' parameter before it is used in a database query. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request containing malicious SQL commands. Successful exploitation allows for boolean-based and time-based blind SQL injection, enabling the attacker to extract database contents, modify data, or potentially gain administrative access. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- PHPGurukul Online Course Registration 3.1
Timeline
- 2026-03-25: disclosed: Initial disclosure on GitHub by researcher f1rstb100d
- 2026-04-08: advisory: NVD/VulDB advisory published