CVE-2024-10422
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Attendance and Payroll System 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in /admin/overtime_add.php. Attackers can potentially access, modify, or delete database contents including sensitive employee payroll data. Organizations using this specific software version are affected.
💻 Affected Systems
- SourceCodester Attendance and Payroll System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive employee payroll data, attendance records, and potential privilege escalation
If Mitigated
Limited impact with proper input validation, WAF rules, and database permissions in place
🎯 Exploit Status
Exploit requires admin access to reach /admin/overtime_add.php endpoint; SQL injection is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider: 1. Check vendor website for updates 2. Implement parameterized queries 3. Apply input validation 4. Consider replacing with alternative software
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize 'id' parameter before processing
Add input validation in overtime_add.php: if(!is_numeric($_POST['id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database user with minimal privileges (read-only if possible)
- Monitor /admin/overtime_add.php access logs for suspicious activity
- Consider migrating to alternative payroll software
🔍 How to Verify
Check if Vulnerable:
Test the /admin/overtime_add.php endpoint with SQL injection payloads in the 'id' parameter (e.g., id=1' OR '1'='1)Check Version:
Check software version in admin panel or review source code headersVerify Fix Applied:
Verify that SQL injection payloads no longer work and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts to admin panel
- Suspicious parameter values in /admin/overtime_add.php requests
Network Indicators:
- SQL keywords in POST parameters to admin endpoints
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri="/admin/overtime_add.php" AND (param="id" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP")