CVE-2024-3360
📋 TL;DR
CVE-2024-3360 is a critical SQL injection vulnerability in SourceCodester Online Library System 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in admin/books/index.php. This affects all deployments of this specific library management software version. Attackers can potentially read, modify, or delete database content without authentication.
💻 Affected Systems
- SourceCodester Online Library System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chain
Likely Case
Unauthorized data access, privilege escalation, and potential authentication bypass
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Public exploit code available on GitHub, simple parameter manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to sanitize 'id' parameter before SQL execution
Modify admin/books/index.php to validate/sanitize the id parameter using prepared statements or type casting
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL injection patterns in id parameter
🧯 If You Can't Patch
- Block external access to admin/books/index.php via firewall rules
- Implement strict database user permissions with read-only access where possible
🔍 How to Verify
Check if Vulnerable:
Test admin/books/index.php?id=1' OR '1'='1 to see if SQL error occursCheck Version:
Check software version in system configuration or about pageVerify Fix Applied:
Test same payload after fix - should return normal response without SQL errors📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests to admin/books/index.php with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND (uri="*admin/books/index.php*" AND (param="*id=*'*" OR param="*id=*%27*"))🔗 References
- https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-02
- https://vuldb.com/?ctiid.259464
- https://vuldb.com/?id.259464
- https://vuldb.com/?submit.310424
- https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-02
- https://vuldb.com/?ctiid.259464
- https://vuldb.com/?id.259464
- https://vuldb.com/?submit.310424
