CVE-2024-6418
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Medicine Tracker System 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter during user registration. Attackers can potentially access, modify, or delete database contents. All deployments of this specific software version are affected.
💻 Affected Systems
- SourceCodester Medicine Tracker System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, user account compromise, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries or input validation as described in workarounds.
🔧 Temporary Workarounds
Implement Parameterized Queries
allReplace raw SQL concatenation with prepared statements in the Users.php registration function.
Modify /classes/Users.php to use PDO or mysqli prepared statements for the register_user function
Input Validation and Sanitization
allAdd strict input validation for username parameter to reject SQL special characters.
Add validation: if(preg_match('/[\'"\;\-\#\*]/', $username)) { reject input; }
🧯 If You Can't Patch
- Block access to /classes/Users.php?f=register_user at web application firewall or network level
- Implement database user with minimal privileges (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the registration endpoint with SQL injection payloads like: username=admin' OR '1'='1Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt SQL injection after implementing parameterized queries - should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple registration attempts with special characters in username
Network Indicators:
- HTTP POST requests to /classes/Users.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/classes/Users.php" AND (param="username" AND value MATCHES "[';\-]|OR|UNION|SELECT")🔗 References
- https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Users_php_sqli.md
- https://vuldb.com/?ctiid.270009
- https://vuldb.com/?id.270009
- https://vuldb.com/?submit.365240
- https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Users_php_sqli.md
- https://vuldb.com/?ctiid.270009
- https://vuldb.com/?id.270009
- https://vuldb.com/?submit.365240
