SQL Injection in PHPGurukul Complaint Management System

A critical SQL injection vulnerability, identified as CVE-2026-75089, exists within version 1.0 of the PHPGurukul Complaint Management System. The flaw resides in the 'email' argument handled by the 'user/check_availability.php' file. This vulnerability enables remote, unauthenticated attackers to inject malicious SQL commands, potentially leading to unauthorized data exfiltration, modification, or destruction within the application's backend database. Publicly available exploit code for this vulnerability has been identified, increasing the risk of active exploitation. Organizations utilizing this system are at significant risk if they cannot immediately isolate or patch the affected component.

Attack Chain

1. Attacker performs reconnaissance to identify instances of PHPGurukul Complaint Management System 1.0.
2. Attacker crafts an HTTP GET or POST request targeting the 'user/check_availability.php' endpoint.
3. Attacker injects malicious SQL syntax into the 'email' parameter value.
4. The web application fails to properly sanitize the 'email' input before passing it to the database query.
5. The backend database executes the attacker-supplied SQL commands.
6. Attacker leverages the database access to extract sensitive information or modify records.
7. Final objective: Complete compromise of the application data or potential service disruption.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to gain unauthorized access to backend database information. In enterprise environments, this could result in the theft of user data, credential harvesting, or further compromise of the web server infrastructure.

Recommendation

• Immediately audit web server logs for HTTP requests directed at 'user/check_availability.php' containing abnormal characters such as single quotes, semicolons, or SQL keywords in the 'email' parameter.
• Implement Web Application Firewall (WAF) rules to inspect and block requests to the vulnerable endpoint that contain SQL injection payloads.
• If no patch is available, restrict access to the 'user/check_availability.php' file via server-side access controls.
• Deploy the provided Sigma rule to your web server access logs to detect exploitation attempts.