CVE-2024-7669
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Car Driving School Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in the delete_enrollment function. Attackers can potentially read, modify, or delete database contents, including sensitive student and administrative data. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Car Driving School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student records, enrollment data, and administrative credentials stored in the database.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting SQL execution.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in Master.php delete_enrollment function and validate/sanitize all user inputs.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests targeting the vulnerable endpoint.
Input Validation Filter
allImplement server-side input validation to reject non-numeric values for the 'id' parameter.
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all database queries from the application.
🔍 How to Verify
Check if Vulnerable:
Test the delete_enrollment endpoint with SQL injection payloads in the 'id' parameter (e.g., ' OR '1'='1).Check Version:
Check the software version in the application's admin panel or configuration files.Verify Fix Applied:
Verify that parameterized queries are implemented and SQL injection attempts return error messages without executing.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed delete operations with malformed IDs
- Database queries with suspicious patterns from the application
Network Indicators:
- HTTP requests to Master.php with SQL keywords in parameters
- Unusual database traffic patterns from the application server
SIEM Query:
source="web_logs" AND (uri="*Master.php*" AND (param="*id=*OR*" OR param="*id=*UNION*" OR param="*id=*SELECT*"))