CVE-2024-2147
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Online Mobile Management Store 1.0 allows attackers to bypass authentication via the username parameter in /admin/login.php. Attackers can execute arbitrary SQL commands remotely, potentially gaining unauthorized access to the admin panel. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Mobile Management Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including database exfiltration, privilege escalation to admin, and potential remote code execution through SQL injection chaining.
Likely Case
Authentication bypass leading to unauthorized admin access, data theft from the database, and potential manipulation of store operations.
If Mitigated
Failed login attempts logged, but no successful exploitation due to input validation and parameterized queries.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires no authentication and uses simple SQL injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize username parameter before SQL processing
Modify /admin/login.php to add: $username = mysqli_real_escape_string($conn, $_POST['username']);
Web Application Firewall Rule
allBlock SQL injection patterns in the username parameter
Add WAF rule: deny if contains ' OR '1'='1' --
deny if contains UNION SELECT
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test with SQL injection payload in username field: admin' OR '1'='1' --Check Version:
Check source code or documentation for version 1.0 referenceVerify Fix Applied:
Attempt same SQL injection payload; should result in failed login rather than successful bypass📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with SQL patterns in username field
- Successful admin login from unusual IP addresses
Network Indicators:
- HTTP POST requests to /admin/login.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/admin/login.php" AND (username="*OR*" OR username="*UNION*" OR username="*SELECT*")🔗 References
- https://github.com/vanitashtml/CVE-Dumps/blob/main/Sql%20Injection%20Authentication%20Bypass%20in%20Mobile%20Management%20Store.md
- https://vuldb.com/?ctiid.255500
- https://vuldb.com/?id.255500
- https://github.com/vanitashtml/CVE-Dumps/blob/main/Sql%20Injection%20Authentication%20Bypass%20in%20Mobile%20Management%20Store.md
- https://vuldb.com/?ctiid.255500
- https://vuldb.com/?id.255500
