CVE-2024-42565
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in an ERP system's contact deletion function. Attackers can execute arbitrary SQL commands by manipulating the 'id' parameter, potentially compromising the entire database. Any organization using the vulnerable ERP commit is affected.
💻 Affected Systems
- ERP system with commit 44bd04
📦 What is this software?
Erp by Jerryhanjj
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution on the database server.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the ERP system.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
SQL injection via GET parameter is straightforward to exploit; authentication required to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Identify if using commit 44bd04
2. Check for updated commits from the ERP project
3. Apply parameterized queries to the vulnerable endpoint
4. Implement proper input validation for the id parameter
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for the id parameter
// PHP example: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication requirements
- Implement database user privilege restrictions to limit potential damage from SQL injection
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /index.php/basedata/contact/delete?action=delete with SQL injection payloads in the id parameterCheck Version:
Check git commit history for commit 44bd04: git log --oneline | grep 44bd04Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple delete requests with unusual id parameters
- Database queries with UNION, SELECT, or other SQL keywords from the application
Network Indicators:
- HTTP requests to the vulnerable endpoint with SQL injection patterns in parameters
- Unusual database traffic patterns from the application server
SIEM Query:
source="web_logs" AND uri="/index.php/basedata/contact/delete" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR 1=1*")