CVE-2024-10354
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Petrol Pump Management Software 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in the /admin/print.php file. Attackers can exploit this remotely to potentially access, modify, or delete database content. Organizations using this software are affected.
💻 Affected Systems
- SourceCodester Petrol Pump Management Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or complete system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized database access allowing extraction of sensitive information like customer data, financial records, or administrative credentials
If Mitigated
Limited impact if proper input validation and database permissions restrict damage to non-critical data
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily exploitable
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter in /admin/print.php
Modify /admin/print.php to validate 'id' parameter as integer: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection attempts targeting /admin/print.php
WAF rule: Block requests to /admin/print.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Remove or restrict access to /admin/print.php file
- Implement network segmentation to isolate the vulnerable system from sensitive networks
🔍 How to Verify
Check if Vulnerable:
Test /admin/print.php?id=1' OR '1'='1 to see if SQL error occursCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads to confirm they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Multiple requests to /admin/print.php with unusual parameters
Network Indicators:
- HTTP requests to /admin/print.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri="/admin/print.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR*" OR param="*'*")