CVE-2024-11099
📋 TL;DR
This critical SQL injection vulnerability in Job Recruitment 1.0 allows attackers to manipulate database queries through the email parameter in /login.php. Attackers can potentially steal sensitive data, modify database contents, or gain unauthorized access. All deployments of Job Recruitment 1.0 with the vulnerable login.php file are affected.
💻 Affected Systems
- Job Recruitment
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, personal data, job applications, and administrative access leading to full system takeover.
Likely Case
Data exfiltration of user credentials and sensitive information, potential privilege escalation to administrative accounts.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or failed login attempts visible.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily weaponizable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize email parameter input before processing
Modify /login.php to include: $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:email "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the Job Recruitment system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the web application
🔍 How to Verify
Check if Vulnerable:
Test /login.php endpoint with SQL injection payloads like: email=test' OR '1'='1Check Version:
Check application files for version information or review /login.php file metadataVerify Fix Applied:
Attempt SQL injection payloads and verify they are rejected or sanitized without database errors📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in email parameter logs
- Multiple failed login attempts with SQL-like patterns
- Database error messages containing SQL fragments
Network Indicators:
- HTTP POST requests to /login.php with SQL keywords in parameters
- Unusual database query patterns from web server IP
SIEM Query:
source="web_logs" AND uri="/login.php" AND (email="*'*" OR email="*OR*" OR email="*UNION*" OR email="*SELECT*")