CVE-2024-10506
📋 TL;DR
This critical SQL injection vulnerability in Blood Bank System 1.0 allows attackers to manipulate database queries through the Bloodname parameter in /admin/blood/update/B-.php. Remote attackers can potentially read, modify, or delete database contents. All users running the vulnerable version are affected.
💻 Affected Systems
- code-projects Blood Bank System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive medical data exfiltration, authentication bypass, or system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to blood donor records, patient information, and administrative data through SQL injection attacks.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
Exploit requires admin access to reach vulnerable endpoint. SQL injection payloads are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize Bloodname parameter
// In /admin/blood/update/B-.php, add: $bloodname = mysqli_real_escape_string($conn, $_POST['Bloodname']);
Web Application Firewall
allDeploy WAF with SQL injection rules
🧯 If You Can't Patch
- Restrict access to /admin/blood/update/B-.php using IP whitelisting
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Test Bloodname parameter with SQL injection payloads like ' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify no database errors or unexpected behavior📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to /admin/blood/update/B-.php with SQL keywords
SIEM Query:
source="web_logs" AND uri="/admin/blood/update/B-.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "OR '1'='1'")