CVE-2024-12966
📋 TL;DR
This critical SQL injection vulnerability in Job Recruitment 1.0 allows remote attackers to execute arbitrary SQL commands by manipulating the cname/url parameters in the cn_update function. Attackers can potentially read, modify, or delete database content, including sensitive user data. All systems running Job Recruitment 1.0 with the vulnerable /_parse/_all_edits.php file are affected.
💻 Affected Systems
- Job Recruitment
📦 What is this software?
Job Recruitment by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive recruitment data (applicant info, employer details), database manipulation, or credential theft.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage scope.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation requires no authentication. Simple SQL injection techniques work.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider applying manual fixes or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the cn_update function in /_parse/_all_edits.php
Edit /_parse/_all_edits.php to replace raw SQL with prepared statements
File Access Restriction
allRestrict access to the vulnerable PHP file via web server configuration
Add 'Deny from all' to .htaccess for /_parse/ directory (Apache)
Configure nginx location block to deny access to /_parse/
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting cname/url parameters
- Isolate the Job Recruitment system behind a firewall with strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if /_parse/_all_edits.php exists and contains the cn_update function with unsanitized cname/url parametersCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test SQL injection attempts against the cname/url parameters should be blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /_parse/_all_edits.php with SQL keywords in parameters
Network Indicators:
- HTTP POST requests to /_parse/_all_edits.php containing SQL injection payloads
SIEM Query:
source="web_logs" AND uri="/_parse/_all_edits.php" AND (cname="*' OR*" OR url="*' OR*")