CVE-2024-12967
📋 TL;DR
A critical SQL injection vulnerability in code-projects Job Recruitment 1.0 allows attackers to manipulate database queries through the fname/lname parameters in the fln_update function. This enables unauthorized data access, modification, or deletion. All installations of Job Recruitment 1.0 with the vulnerable file are affected.
💻 Affected Systems
- code-projects Job Recruitment
📦 What is this software?
Job Recruitment by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive job applicant data, user credentials, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to reject SQL special characters in fname/lname parameters.
Edit /_parse/_all_edits.php to sanitize inputs before SQL query execution.
File Access Restriction
linuxBlock direct access to the vulnerable PHP file via web server configuration.
Add 'Deny from all' to .htaccess for /_parse/ directory (Apache)
Use location block to deny access in nginx config
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting fname/lname parameters.
- Restrict database user permissions to minimum required operations.
🔍 How to Verify
Check if Vulnerable:
Check if /_parse/_all_edits.php exists and contains unsanitized fname/lname parameters in SQL queries.Check Version:
Check software version in admin panel or readme files.Verify Fix Applied:
Test with SQL injection payloads in fname/lname parameters to confirm they're properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /_parse/_all_edits.php with special characters
Network Indicators:
- HTTP POST requests to vulnerable endpoint with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/_parse/_all_edits.php" AND (param="fname" OR param="lname") AND (content="UNION" OR content="SELECT" OR content="INSERT" OR content="DELETE")