CVE-2024-12492
📋 TL;DR
This critical SQL injection vulnerability in Farmacia 1.0 allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in /visualizar-usuario.php. Attackers can potentially read, modify, or delete database contents, including sensitive user data. All users running Farmacia 1.0 with the vulnerable file accessible are affected.
💻 Affected Systems
- Farmacia
📦 What is this software?
Farmacia by Anisha
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive user data, database manipulation, or potential authentication bypass.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Public exploit available on GitHub. Simple SQL injection via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
Modify /visualizar-usuario.php to validate 'id' parameter as integer using is_numeric() or filter_var()
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Restrict access to /visualizar-usuario.php using IP whitelisting or authentication
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test by accessing /visualizar-usuario.php?id=1' OR '1'='1 and checking for SQL errors or unexpected behaviorCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads and verify proper error handling or parameter rejection📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Multiple requests to /visualizar-usuario.php with unusual parameters
- Database error messages in application logs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/visualizar-usuario.php" AND (param="id" AND value MATCH "[';]|OR|UNION|SELECT")