CVE-2024-5976
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Attackers can remotely exploit the log_employee function to execute arbitrary SQL commands by manipulating the employee_code parameter. Organizations using this specific version of the gate pass logging system are affected.
💻 Affected Systems
- SourceCodester Employee and Visitor Gate Pass Logging System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive employee/visitor data, data exfiltration, and potential system takeover through SQL injection.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub; SQL injection via employee_code parameter is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check SourceCodester website for security updates. 2. If patch available, download and apply. 3. Test functionality after patching.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize employee_code parameter
Modify /classes/Master.php to add: $employee_code = mysqli_real_escape_string($conn, $_POST['employee_code']);
Web Application Firewall
allDeploy WAF with SQL injection rules
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access
🔍 How to Verify
Check if Vulnerable:
Test the /classes/Master.php?f=log_employee endpoint with SQL injection payloads in employee_code parameterCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads; should return error or sanitized response instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL syntax
- Requests to /classes/Master.php with suspicious parameters
Network Indicators:
- Unusual database connection patterns
- SQL error messages in HTTP responses
SIEM Query:
source="web_logs" AND uri="/classes/Master.php" AND (param="employee_code" AND value CONTAINS "' OR '" OR "--" OR ";")