CVE-2024-50766
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the id parameter in takeSurvey.php. It affects all deployments of SourceCodester Survey Application System 1.0. Successful exploitation could lead to complete database compromise.
💻 Affected Systems
- SourceCodester Survey Application System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential server takeover via SQL injection to file write or command execution.
Likely Case
Database information disclosure, authentication bypass, and data manipulation of survey results and user data.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns.
🎯 Exploit Status
Public proof-of-concept available in Medium article. Simple SQL injection via GET parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check vendor website for updates
2. Apply parameterized queries in takeSurvey.php
3. Implement input validation for id parameter
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns in id parameter
Input Validation
allAdd server-side validation to ensure id parameter contains only numeric values
🧯 If You Can't Patch
- Block external access to the survey application using network ACLs
- Implement rate limiting and monitoring on takeSurvey.php endpoint
🔍 How to Verify
Check if Vulnerable:
Test takeSurvey.php?id=1' OR '1'='1 and observe SQL error or unexpected behaviorCheck Version:
Check application version in admin panel or source code commentsVerify Fix Applied:
Test with SQL injection payloads and verify proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual parameter values in id field
- Multiple rapid requests to takeSurvey.php
Network Indicators:
- SQL keywords in HTTP GET parameters
- Unusual database query patterns
SIEM Query:
source=web_logs AND (url="*takeSurvey.php*" AND param="*id=*'*" OR param="*id=*%27*")