CVE-2024-5051
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Gas Agency Management System 1.0 allows attackers to manipulate database queries through the edituser.php file's id parameter. Remote attackers can potentially access, modify, or delete sensitive data in the database. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Gas Agency Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data destruction, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, and data manipulation affecting user accounts and sensitive agency information.
If Mitigated
Limited impact with proper input validation and database permissions preventing data exfiltration or modification.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to edituser.php
Modify edituser.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE id = ?'); $stmt->bind_param('i', $_GET['id']);
Web Application Firewall Rules
allBlock SQL injection patterns targeting edituser.php
Add WAF rule: SecRule REQUEST_URI "@contains edituser.php" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation and monitor for unusual database queries
🔍 How to Verify
Check if Vulnerable:
Test edituser.php?id=1' OR '1'='1 to see if it returns database errors or unexpected resultsCheck Version:
Check the software version in admin panel or readme filesVerify Fix Applied:
Test with SQL injection payloads after implementing fixes to ensure they're blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to edituser.php with SQL syntax in parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) targeting edituser.php
SIEM Query:
source="web_logs" AND uri="*edituser.php*" AND (query="*' OR*" OR query="*UNION*" OR query="*SELECT*" OR query="*--*" OR query="*;*" OR query="*/*")