CVE-2023-24198
📋 TL;DR
Raffle Draw System v1.0 contains SQL injection vulnerabilities in the save_winner.php endpoint via ticket_id and draw parameters. This allows attackers to execute arbitrary SQL commands on the database. Anyone running this specific version of the software is affected.
💻 Affected Systems
- Raffle Draw System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, manipulation of raffle results, extraction of sensitive user information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
SQL injection via GET/POST parameters is straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Review the save_winner.php source code. 2. Replace raw SQL queries with parameterized prepared statements. 3. Implement proper input validation for ticket_id and draw parameters. 4. Test thoroughly before deployment.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Input Validation Filter
allAdd server-side validation to reject non-numeric values for ticket_id and draw parameters.
🧯 If You Can't Patch
- Block external access to save_winner.php endpoint using firewall rules or web server configuration.
- Implement database user with minimal privileges (read-only if possible) for the application.
🔍 How to Verify
Check if Vulnerable:
Test save_winner.php endpoint with SQL injection payloads like ' OR '1'='1 in ticket_id or draw parameters.Check Version:
Check PHP files for version comments or compare file hashes with known v1.0 distribution.Verify Fix Applied:
Attempt SQL injection tests after patching; successful queries should return errors or no data.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to save_winner.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in parameters
SIEM Query:
source="web_logs" AND uri="*save_winner.php*" AND (param="*ticket_id*" OR param="*draw*") AND (content="*' OR*" OR content="*UNION*" OR content="*SELECT*" OR content="*--*" OR content="*;*" OR content="*/*")🔗 References
- https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_winner.md
- https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html
- https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_winner.md
- https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html
