CVE-2024-51101 is a critical severity (CVSS 9.8) SQL injection in PHPGurukul Restaurant Table Booking System 1.0, through the searchdata parameter of the check-status page. The record lists no vendor fix, so take the application off the internet, or retire it, and fix the query handling if you maintain a copy.
What's affected
The record names PHPGurukul Restaurant Table Booking System using PHP and MySQL, version 1.0. The affected file is rtbs/check-status.php and the parameter is searchdata.
The record does not list a patched version, and the researcher write up referenced in the NVD record could not be retrieved during review. No vendor advisory is cited. Check the vendor site for an update before assuming one exists.
This kind of project is often downloaded as sample source code and put into production by small businesses, so the code may be running somewhere without anyone tracking it.
How to check if you're exposed
Search your servers for the application files and check whether the page is reachable.
find /var/www -name "check-status.php" -path "*rtbs*" 2>/dev/null
If the file is there, review how the search term reaches the database query. Queries that join the parameter into the SQL text are the weakness. Look at web server logs for odd requests to the page, such as very long or unusual values in the search field.
What to do now
- Find any copies of this application in your estate.
- Take the application offline or put it behind authentication and a firewall until it is fixed.
- Rewrite the query to use prepared statements with bound parameters.
- Give the database account used by the application only the rights it needs.
- Review the database and logs for signs of unexpected access, and rotate the credentials.
Why it matters
The weakness is CWE-89 (SQL Injection). The application places the search value straight into the SQL text, so someone can change the meaning of the query. That can expose or modify data in the database, and in some setups reach beyond it.
The cure has been known for a long time: parameterised queries. The reason this class of bug is still common is that small applications are written quickly and never reviewed. The 9.8 score reflects no login and a network reach. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-51101.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2024-51101?
The record lists none. Treat the application as unfixed unless the vendor says otherwise.
What is the lasting fix?
Use prepared statements with bound parameters for every query that takes user input.
Sources
- Researcher write up (listed in the NVD record, not retrievable during review)
- Gold entry for CVE-2024-51101
Last reviewed: 19 October 2026.
