CVE-2024-5896
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in the save_users function. Attackers can remotely exploit this to steal, modify, or delete database contents. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Employee and Visitor Gate Pass Logging System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, system takeover, and potential lateral movement to other systems.
Likely Case
Unauthorized data access, credential theft, and potential data manipulation affecting employee and visitor records.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify /classes/Users.php to implement proper input validation and use prepared statements for SQL queries.
Edit /classes/Users.php and replace raw SQL queries with parameterized queries using PDO or mysqli prepared statements.
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Configure WAF rules to block SQL injection patterns in POST parameters, particularly targeting the 'id' parameter.
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls and monitor all database queries.
- Implement network segmentation to limit potential lateral movement if the system is compromised.
🔍 How to Verify
Check if Vulnerable:
Check if the system is running version 1.0 of SourceCodester Employee and Visitor Gate Pass Logging System. Review /classes/Users.php for raw SQL queries without parameterization.Check Version:
Check system documentation or configuration files for version information. No standard command available.Verify Fix Applied:
Test the save_users endpoint with SQL injection payloads to confirm they are properly blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or unusual parameter values in web server logs
- Unexpected database schema changes
Network Indicators:
- SQL injection patterns in HTTP POST requests to /classes/Users.php?f=save
- Unusual outbound database connections
SIEM Query:
source="web_server" AND uri="/classes/Users.php" AND (param="id" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--"))