CVE-2024-5135 is a high severity (CVSS 7.3) SQL injection in PHPGurukul Directory Management System. The username input handled by /admin/index.php reaches a database query unsafely. The record names no fixed version, so remove the application from exposure or patch the query yourself.
What's affected
The record lists PHPGurukul Directory Management System (version 1.0) and says the flaw is in /admin/index.php, through the username argument. This is the administrator sign in page. Only the username argument is named, which shows that a single field is enough.
The record gives no fixed version and no vendor patch, and the public write up was posted by an independent researcher. The identifier VDB-265211 is VulDB's tracking number. Sources of this kind describe projects distributed as learning or demo code, so a patch from the author may never arrive.
How to check if you're exposed
First find out whether you run this software at all. Search your web roots and repositories:
find /var/www -name 'index.php' 2>/dev/null
grep -rn "username" /var/www --include=*.php | head
If the file is present, open it and look for the parameter being placed straight into a query string. Review web server logs for requests to this path that carry quote characters or SQL keywords in the parameter. A web application scan of a staging copy can confirm the behavior without touching production.
What to do now
- Block /admin/ from the internet or require a VPN.
- Use prepared statements on the login query and verify hashed passwords in code.
- Check the admin user list for accounts you did not create.
- Change admin passwords after the fix.
- Review the directory's content for unexpected edits.
- Scan the fixed app again with a dynamic tool.
Why it matters
SQL injection (CWE-89) happens when user input is concatenated into a query string, so the database cannot tell data from instructions. The result depends on database privileges and on what the query does: reading rows the page never meant to show, changing them, or in some setups reaching further. An injectable admin login hands over the keys. The directory application edits public listings, so a successful attacker could change what visitors see, a quieter harm than a data dump.
The published description says the exploit has been disclosed to the public and may be used, so assume that anyone who looks can find the technique. The record does not set the KEV flag, so there is no CISA report of active exploitation in it.
Quick check
Is the password field the only problem?
The record names the username argument for this CVE.
What else should I change?
Admin credentials, and any password reused elsewhere.
Sources
Last reviewed: 19 October 2026.
