CVE-2024-10139
📋 TL;DR
This critical SQL injection vulnerability in Pharmacy Management System 1.0 allows attackers to execute arbitrary SQL commands through the name parameter in /add_new_supplier.php. Attackers can remotely exploit this to access, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- Pharmacy Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive patient/pharmacy data, system takeover via command execution, and permanent data destruction
Likely Case
Data exfiltration of pharmacy records, supplier information, and potential credential theft from database
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure
🎯 Exploit Status
Public exploit code available; SQL injection via name parameter requires minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If no patch available, implement workarounds 3. Consider replacing with supported software
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameterized queries and input validation to /add_new_supplier.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('INSERT INTO suppliers (name) VALUES (?)'); $stmt->bind_param('s', $name);
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate system behind firewall with strict network access controls
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /add_new_supplier.php with SQL injection payloads in name parameter (e.g., name=test' OR '1'='1)Check Version:
Check PHP files for version comments or database configuration filesVerify Fix Applied:
Test with same payloads; should receive error or sanitized response instead of SQL execution📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts after supplier addition
- Requests to /add_new_supplier.php with SQL keywords in parameters
Network Indicators:
- Unusual database connection patterns
- Large data exfiltration from database server
- POST requests with SQL syntax in payload
SIEM Query:
source="web_logs" AND uri="/add_new_supplier.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*'1'='1*")