CVE-2024-7378
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in the /manage_question.php file of Simple Realtime Quiz System 1.0. Attackers can potentially read, modify, or delete database contents, including sensitive user data. Organizations using this specific version of the quiz system are affected.
💻 Affected Systems
- SourceCodester Simple Realtime Quiz System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to execute operating system commands.
Likely Case
Unauthorized access to sensitive quiz data, user information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit code is publicly available on GitHub gist. SQL injection vulnerabilities are commonly weaponized in automated attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify /manage_question.php to use prepared statements with parameterized queries instead of concatenating user input into SQL.
Edit PHP file to replace direct variable usage with PDO or mysqli prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the /manage_question.php endpoint.
Configure WAF to detect and block SQL injection attempts on manage_question.php
🧯 If You Can't Patch
- Isolate the vulnerable system behind a firewall with strict access controls
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test the /manage_question.php endpoint with SQL injection payloads in the 'id' parameter (e.g., id=1' OR '1'='1).Check Version:
Check application version in admin panel or readme files. No standard command available.Verify Fix Applied:
Test with SQL injection payloads after implementing parameterized queries to confirm they no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to /manage_question.php with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection patterns targeting /manage_question.php
SIEM Query:
source="web_server" AND uri="/manage_question.php" AND (param="id" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR '1'='1")