CVE-2024-37858
📋 TL;DR
This SQL injection vulnerability in Lost and Found Information System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in the admin categories management page. Attackers can escalate privileges, potentially gaining full administrative control. All deployments of version 1.0 are affected.
💻 Affected Systems
- Lost and Found Information System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, data theft, data manipulation, and potential lateral movement to other systems.
Likely Case
Privilege escalation to admin level, allowing modification of all system data and user accounts.
If Mitigated
Limited impact with proper input validation and database permissions restricting SQL execution.
🎯 Exploit Status
Public exploit code available on Packet Storm. Simple SQL injection via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify php-lfis/admin/categories/manage_category.php to validate and sanitize the id parameter using prepared statements.
Replace vulnerable SQL queries with prepared statements using PDO or mysqli
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the id parameter.
Add WAF rule: deny requests with SQL keywords in id parameter to manage_category.php
🧯 If You Can't Patch
- Restrict access to php-lfis/admin/ directory using IP whitelisting or authentication
- Disable or remove the vulnerable system entirely and use alternative software
🔍 How to Verify
Check if Vulnerable:
Test by accessing /php-lfis/admin/categories/manage_category.php?id=1' OR '1'='1 and checking for SQL errors or unexpected behavior.Check Version:
Check version in system documentation or configuration files; no standard command available.Verify Fix Applied:
Attempt SQL injection tests and verify they are blocked or properly handled without database errors.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Multiple requests to manage_category.php with suspicious id parameters
- Admin login attempts from unusual IPs
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in id parameter
- Unusual database queries from web server IP
SIEM Query:
source="web_logs" AND uri="/php-lfis/admin/categories/manage_category.php" AND (id="*'*" OR id="*UNION*" OR id="*SELECT*")