CVE-2024-12978
📋 TL;DR
This critical SQL injection vulnerability in Job Recruitment 1.0 allows remote attackers to execute arbitrary SQL commands via the jid/limit parameters in the add_req function. Attackers can potentially read, modify, or delete database content, including sensitive user data. All deployments of Job Recruitment 1.0 with the vulnerable /_parse/_all_edits.php file are affected.
💻 Affected Systems
- Job Recruitment
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access and extraction of sensitive information like user credentials, personal data, and application configuration.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If no patch available, implement workarounds 3. Consider replacing with alternative software
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize jid and limit parameters before processing
Modify /_parse/_all_edits.php to validate and sanitize input parameters
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rules to detect and block SQL injection attempts to /_parse/_all_edits.php
🧯 If You Can't Patch
- Restrict access to /_parse/_all_edits.php via firewall rules or authentication
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test the /_parse/_all_edits.php endpoint with SQL injection payloads in jid or limit parametersCheck Version:
Check application files or documentation for version informationVerify Fix Applied:
Attempt SQL injection after fixes and verify no database errors or unexpected behavior occurs📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /_parse/_all_edits.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri="/_parse/_all_edits.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*1=1*")