CVE-2023-24726
📋 TL;DR
Art Gallery Management System v1.0 contains a SQL injection vulnerability in the viewid parameter on the enquiry page. This allows attackers to execute arbitrary SQL commands on the database. Anyone running this specific version of the software is affected.
💻 Affected Systems
- Art Gallery Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
SQL injection via GET parameter requires minimal technical skill to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Replace vulnerable code with parameterized queries or use alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for the viewid parameter
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM enquiries WHERE id = ?'); $stmt->bind_param('i', $viewid);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database access attempts
🔍 How to Verify
Check if Vulnerable:
Test the enquiry page with SQL injection payloads like: /enquiry.php?viewid=1' OR '1'='1Check Version:
Check PHP files for version comments or compare with original v1.0 source codeVerify Fix Applied:
Verify that parameterized queries are implemented and SQL injection payloads no longer work📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed parameter validation attempts
- Suspicious database queries from web server
Network Indicators:
- HTTP requests with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND ("UNION SELECT" OR "OR '1'='1" OR "SQL syntax")🔗 References
- https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24726/CVE-2023-24726.txt
- https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
- https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
- https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-24726/CVE-2023-24726.txt
- https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
- https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
