External risk intelligence

Phpgurukul Beauty Parlour Management System SQL Injection in Login

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-53480

The vulnerability exists in a login.php file within a management system web application. As a web-based login interface designed to authenticate users, it is commonly deployed as an internet-facing service or portal to allow remote access for users, making public network reachability a standard part of its deployment pattern.

SQL Injection

Phpgurukul Beauty Parlour Management System

1.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability identified in the Beauty Parlour Management System, specifically impacting version 1.1. The flaw, a SQL injection, could allow unauthorized individuals to potentially access or manipulate sensitive data through the system's login page if it is exposed to the internet. The primary concern is to confirm if this specific system and version are in use within our environment.

Allows data access or changes via login.
Critical flaw in a management system.
Confirm if our systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `login.php` page. This request targets the `emailcont` parameter, which is not properly validated. Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized access to sensitive information, modification of data, or disruption of the system.

Accessible via the internet.
Vulnerable `emailcont` parameter in `login.php`.
Database compromise and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `login.php` file could allow an unauthenticated attacker to manipulate database queries through the `emailcont` parameter. This could potentially expose or modify sensitive information stored within the system's database when exploited.

Customer and system data at risk.
Exploited via the login form.
Unauthorized access and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are most likely responsible for addressing this SQL injection vulnerability in the Beauty Parlour Management System. The immediate first step should be to identify all instances of this system within the environment, confirm its accessibility from the internet, and then determine its business criticality to prioritize remediation efforts.

Application owners should own the issue.
Verify system accessibility and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Phpgurukul Beauty Parlour Management System?

It is a web-based application designed to help salon owners manage daily operations such as tracking appointments, services, and customer records. The software runs on a web server and uses a backend database to store these operational details, which is the component impacted by this security flaw.

How does SQL injection affect CVE-2024-53480?

This vulnerability is classified as CWE-89, which means the application fails to properly sanitize user input. In this specific case, the login page does not safely handle data entered into the 'emailcont' field. Because the input is processed directly by the database, an attacker can supply malicious commands instead of a normal email address, tricking the system into executing unauthorized database operations.

When does this vulnerability pose a risk?

The risk occurs when an attacker submits a specially crafted request to the login.php page. Simply viewing the login page or navigating the site normally does not trigger the vulnerability. The issue is only activated when an attacker intentionally sends malicious input through the specific 'emailcont' parameter to manipulate the underlying database queries.

Do I need to worry if my system is internal-only?

Halo Surface Signal indicates that this application is typically deployed as an internet-facing service for remote access. If your instance is restricted to a private internal network, it is less reachable by external attackers. However, you should still evaluate the system's overall accessibility, as any exposed login portal significantly increases the likelihood of this vulnerability being targeted.

What should I do if I run this software?

Begin by auditing your environment to locate all installations of the Beauty Parlour Management System and verify if you are using version 1.1. Once identified, assess how the system is exposed to the network and determine its importance to your business operations. Prioritize these findings to guide your team in planning and applying necessary remediation to secure the login interface.

References

github.com/sbksibi/CVEs/blob/main/CVE-2024-53480.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.