CVE-2024-6968
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Clinics Patient Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'from' and 'to' parameters in the /print_patients_visits.php file. This could lead to data theft, manipulation, or complete system compromise. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Clinics Patient Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including patient records, administrative credentials, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive patient data, modification of medical records, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation trivial for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the vulnerable file, or replace the entire system with a secure alternative.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the /print_patients_visits.php file
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM visits WHERE date BETWEEN ? AND ?'); $stmt->bind_param('ss', $from, $to);
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules
Configure WAF to block SQL injection patterns in URL parameters
🧯 If You Can't Patch
- Block external access to the vulnerable system using network segmentation
- Implement strict database permissions and use read-only database accounts where possible
🔍 How to Verify
Check if Vulnerable:
Test the /print_patients_visits.php endpoint with SQL injection payloads in 'from' and 'to' parametersCheck Version:
Check the system version in admin panel or review source code for version markersVerify Fix Applied:
Attempt SQL injection after implementing fixes and verify no database errors or unexpected results📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
- Multiple failed parameter manipulation attempts
Network Indicators:
- HTTP requests to /print_patients_visits.php with SQL keywords in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (url="*print_patients_visits.php*" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*" OR param="*DELETE*"))