CVE-2024-10805
📋 TL;DR
This critical SQL injection vulnerability in University Event Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in doedit.php. Attackers can potentially read, modify, or delete database content, including sensitive user information. Organizations using this specific software version are affected.
💻 Affected Systems
- University Event Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access and extraction of sensitive information like user credentials, personal data, or event details.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage scope.
🎯 Exploit Status
Exploit details are publicly available on GitHub; remote exploitation is confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize all user inputs, especially the 'id' parameter in doedit.php.
Edit doedit.php to implement parameterized queries or prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting doedit.php.
Configure WAF to block requests containing SQL keywords in doedit.php parameters
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web servers
🔍 How to Verify
Check if Vulnerable:
Test doedit.php with SQL injection payloads in the 'id' parameter; check for database errors or unexpected responses.Check Version:
Check software documentation or configuration files for version information; typically found in readme files or admin panels.Verify Fix Applied:
Verify that parameterized queries are implemented in doedit.php and test with SQL injection payloads to ensure they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to doedit.php with suspicious parameters
Network Indicators:
- HTTP requests to doedit.php containing SQL keywords like UNION, SELECT, OR 1=1
SIEM Query:
source="web_server" AND uri="/doedit.php" AND (request_parameters CONTAINS "UNION" OR request_parameters CONTAINS "SELECT" OR request_parameters CONTAINS "OR 1=1")