CVE-2024-7731
📋 TL;DR
This critical SQL injection vulnerability in Dr.ID Access Control System allows unauthenticated attackers to execute arbitrary SQL commands remotely. Attackers can read, modify, or delete database contents including user credentials, access logs, and system configurations. Organizations using SECOM's Dr.ID Access Control System are affected.
💻 Affected Systems
- SECOM Dr.ID Access Control System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise: attackers gain administrative access, disable physical security controls, exfiltrate sensitive data, and potentially pivot to other network systems.
Likely Case
Data theft and system manipulation: attackers steal user credentials, access logs, and modify access permissions to bypass physical security.
If Mitigated
Limited impact if proper network segmentation and web application firewalls block SQL injection attempts before reaching vulnerable systems.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with automated tools. The unauthenticated nature makes this particularly dangerous.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-8006-036f5-2.html
Restart Required: Yes
Instructions:
1. Contact SECOM for the latest security patch. 2. Apply the patch following vendor instructions. 3. Restart the Dr.ID system. 4. Verify the fix by testing the vulnerable parameter.
🔧 Temporary Workarounds
Web Application Firewall
allDeploy a WAF with SQL injection rules to block malicious requests
Network Segmentation
allIsolate Dr.ID systems from internet and restrict access to authorized IPs only
🧯 If You Can't Patch
- Immediately isolate the Dr.ID system from internet access and restrict to internal network only
- Implement strict input validation at network perimeter or reverse proxy level
🔍 How to Verify
Check if Vulnerable:
Test the specific page parameter with SQL injection payloads (e.g., ' OR '1'='1) and monitor for database errors or unexpected responsesCheck Version:
Check system web interface or contact SECOM for version informationVerify Fix Applied:
After patching, retest with SQL injection payloads - should receive proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in web logs
- Multiple failed login attempts from single IP
- Database error messages in application logs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, INSERT, etc.) to Dr.ID endpoints
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND (url="*page=*" AND (content="SELECT" OR content="UNION" OR content="' OR '"))