CVE-2024-12894
📋 TL;DR
This critical SQL injection vulnerability in TreasureHuntGame's TreasureHunt software allows attackers to execute arbitrary SQL commands by manipulating the 'usuario' parameter in the acesso.php file. Attackers can exploit this remotely without authentication, potentially compromising the entire application database. All users running TreasureHunt up to commit 963e0e0 are affected.
💻 Affected Systems
- TreasureHuntGame TreasureHunt
📦 What is this software?
Treasurehunt by Treasurehuntgame
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, user credential theft, and potential application takeover through administrative account compromise.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities are well-understood and easily weaponized. The commit shows the fix involves parameterized queries, indicating classic SQL injection patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 8bcc649abc35b7734951be084bb522a532faac4e and later
Vendor Advisory: https://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e
Restart Required: No
Instructions:
1. Pull the latest code from the TreasureHunt repository. 2. Verify you have commit 8bcc649abc35b7734951be084bb522a532faac4e or later. 3. Replace the vulnerable acesso.php file with the patched version. 4. No service restart required as PHP files are interpreted on each request.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in the 'usuario' parameter
Input Validation Filter
allAdd input validation to sanitize the 'usuario' parameter before processing
// PHP example: filter_input(INPUT_POST, 'usuario', FILTER_SANITIZE_STRING);
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection detection rules
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check if your TreasureHunt installation includes commit 963e0e0 or earlier in git history: git log --oneline | grep -E '963e0e0|8bcc649'Check Version:
git log --oneline -1Verify Fix Applied:
Verify the current commit includes 8bcc649abc35b7734951be084bb522a532faac4e: git log --oneline -1📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL syntax in username field
- Database query errors containing unusual characters
Network Indicators:
- HTTP POST requests to acesso.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="*access.log*" AND "acesso.php" AND ("usuario=*'*" OR "usuario=*%27*" OR "usuario=*SELECT*" OR "usuario=*UNION*")