CVE-2024-7376
📋 TL;DR
This critical SQL injection vulnerability in Simple Realtime Quiz System 1.0 allows attackers to manipulate database queries through the 'id' parameter in /print_quiz_records.php. Attackers can potentially read, modify, or delete database contents, including sensitive user data. Organizations using this specific version of the quiz system are affected.
💻 Affected Systems
- SourceCodester Simple Realtime Quiz System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive quiz data, user information, and potential privilege escalation
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data
🎯 Exploit Status
Public exploit code available; SQL injection is straightforward to weaponize
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to sanitize 'id' input before processing
Modify /print_quiz_records.php to validate and sanitize the 'id' parameter using prepared statements
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in 'id' parameter
🧯 If You Can't Patch
- Isolate the quiz system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the vulnerable application
🔍 How to Verify
Check if Vulnerable:
Test /print_quiz_records.php?id=1' OR '1'='1 to see if it returns database errors or unexpected resultsCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt SQL injection payloads and verify they are properly sanitized or rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests to /print_quiz_records.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/print_quiz_records.php" AND (param="id" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and|'|--|#)")