CVE-2024-10024
📋 TL;DR
This critical SQL injection vulnerability in Pharmacy Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the name, packing, generic_name, or suppliers_name parameters in the manage_medicine_stock.php file. This affects all users running the vulnerable version of this software, potentially exposing sensitive pharmacy data.
💻 Affected Systems
- code-projects Pharmacy Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including patient records, medication data, financial information, and potential system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive pharmacy data, medication inventory manipulation, patient record exposure, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
Exploit code is publicly available in the GitHub gist reference. SQL injection via multiple parameters makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries in manage_medicine_stock.php or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for name, packing, generic_name, and suppliers_name parameters to reject SQL special characters.
# Add input validation in PHP before database queries
# Example: preg_match('/^[a-zA-Z0-9\s]+$/', $input)
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
# Example ModSecurity rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Network segmentation: Isolate the Pharmacy Management System from internet access and restrict to necessary internal networks only.
- Database hardening: Implement least privilege database accounts, enable logging, and regularly audit database access patterns.
🔍 How to Verify
Check if Vulnerable:
Test the /php/manage_medicine_stock.php endpoint with SQL injection payloads in name, packing, generic_name, or suppliers_name parameters and observe database errors or unexpected behavior.Check Version:
# Check PHP files or documentation for version information
# Typically found in readme files or configuration filesVerify Fix Applied:
Verify that parameterized queries are implemented in manage_medicine_stock.php and test with SQL injection payloads to confirm they are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server logs
- SQL syntax errors in application logs
- Multiple failed parameter manipulation attempts
Network Indicators:
- HTTP requests to /php/manage_medicine_stock.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/php/manage_medicine_stock.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*" OR param="*--*" OR param="*'*")