CVE-2024-0474
📋 TL;DR
This critical SQL injection vulnerability in Dormitory Management System 1.0 allows attackers to manipulate database queries through the username parameter in login.php. Attackers can potentially access, modify, or delete sensitive data including user credentials and personal information. Organizations using this software are affected.
💻 Affected Systems
- code-projects Dormitory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, privilege escalation, and potential system takeover.
Likely Case
Unauthorized data access, credential theft, and potential authentication bypass allowing attackers to gain administrative access.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. SQL injection via username parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in login.php, validate and sanitize all user inputs, and consider replacing with secure software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation and sanitization for username parameter before processing SQL queries
Modify login.php to use prepared statements with parameterized queries
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns in login requests
Add WAF rule: Detect and block SQL keywords in username parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from application servers
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payloads in username field (e.g., admin' OR '1'='1)Check Version:
Check software version in system configuration or about pageVerify Fix Applied:
Attempt SQL injection tests and verify they are rejected or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL patterns
- Successful logins from unusual IP addresses
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri="/login.php" AND (username CONTAINS "' OR" OR username CONTAINS "--" OR username CONTAINS ";")🔗 References
- https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20login.php.pdf
- https://vuldb.com/?ctiid.250579
- https://vuldb.com/?id.250579
- https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20login.php.pdf
- https://vuldb.com/?ctiid.250579
- https://vuldb.com/?id.250579
