CVE-2024-10791
📋 TL;DR
A critical SQL injection vulnerability exists in Codezips Hospital Appointment System 1.0 through the /doctorAction.php file's Name parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All deployments of version 1.0 are affected.
💻 Affected Systems
- Codezips Hospital Appointment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive patient and appointment data, including personal health information and medical records.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection vulnerabilities are commonly weaponized in automated attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or migrating to a different system.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject malicious input in the Name parameter
Modify /doctorAction.php to sanitize the Name parameter using prepared statements or strict input validation
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords like UNION, SELECT, INSERT, DELETE in Name parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test the /doctorAction.php endpoint with SQL injection payloads in the Name parameter (e.g., Name=test' OR '1'='1)Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer produce database errors or unexpected results📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- SQL syntax errors in application logs
- Multiple failed login attempts via /doctorAction.php
Network Indicators:
- HTTP requests to /doctorAction.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/doctorAction.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*")