CVE-2024-6216
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Food Ordering Management System 1.0 allows attackers to manipulate database queries through the 'contact' parameter in add-users.php. Attackers can execute arbitrary SQL commands remotely, potentially compromising the entire database. All users running the affected version are vulnerable.
💻 Affected Systems
- SourceCodester Food Ordering Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, user account compromise, and potential administrative access to the food ordering system.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation straightforward for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider manual code fixes or system replacement.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the add-users.php file
Modify PHP code to use prepared statements: $stmt = $conn->prepare('INSERT INTO users (contact) VALUES (?)'); $stmt->bind_param('s', $contact);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:contact "@rx (union|select|insert|update|delete|drop|--|#|;)" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web servers
🔍 How to Verify
Check if Vulnerable:
Test the add-users.php endpoint with SQL injection payloads in the 'contact' parameterCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Attempt SQL injection after implementing parameterized queries and verify payloads are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed login attempts from single IP
- Suspicious database queries in application logs
Network Indicators:
- SQL keywords in HTTP POST parameters
- Unusual database connection patterns
- High volume of requests to add-users.php
SIEM Query:
source="web_logs" AND ("union select" OR "' OR '1'='1" OR "--" OR ";--") AND uri="*add-users.php*"🔗 References
- https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_add_users_Sqli.md
- https://vuldb.com/?ctiid.269280
- https://vuldb.com/?id.269280
- https://vuldb.com/?submit.359634
- https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_add_users_Sqli.md
- https://vuldb.com/?ctiid.269280
- https://vuldb.com/?id.269280
- https://vuldb.com/?submit.359634
