CVE-2024-7637
📋 TL;DR
CVE-2024-7637 is a critical SQL injection vulnerability in code-projects Online Polling 1.0 that allows remote attackers to execute arbitrary SQL commands via the email parameter in registeracc.php. This affects all installations of Online Polling 1.0 with the vulnerable registration component exposed. Attackers can potentially access, modify, or delete database content without authentication.
💻 Affected Systems
- code-projects Online Polling
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive user data, poll manipulation, or administrative account takeover
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute. The vulnerability is in a straightforward parameter with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider applying manual fixes or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or proper input sanitization to registeracc.php email parameter
Edit registeracc.php to replace direct SQL concatenation with prepared statements using mysqli or PDO
Web Application Firewall Rules
allBlock SQL injection patterns targeting the email parameter
Add WAF rule: deny requests to registeracc.php containing SQL keywords in email parameter
🧯 If You Can't Patch
- Disable or remove registeracc.php file if registration functionality is not required
- Implement network-level restrictions to limit access to the vulnerable endpoint to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Test registeracc.php with SQL injection payloads in email parameter (e.g., email=test' OR '1'='1)Check Version:
Check software version in admin panel or readme files; this affects only version 1.0Verify Fix Applied:
Attempt SQL injection after applying fixes; successful injection should be blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed registration attempts with SQL syntax in email field
- Database queries from unexpected sources
Network Indicators:
- HTTP POST requests to registeracc.php containing SQL keywords (UNION, SELECT, INSERT, etc.) in parameters
SIEM Query:
source="web_logs" AND uri="/registeracc.php" AND (email="*'*" OR email="*UNION*" OR email="*SELECT*")