CVE-2024-7949
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Online Graduate Tracer System allows remote attackers to execute arbitrary SQL commands via the 'request' parameter in /tracking/admin/fetch_genderit.php. Attackers can potentially read, modify, or delete database contents. All users running versions up to 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Graduate Tracer System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database functions allow it
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the affected file.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation and sanitization to the 'request' parameter in fetch_genderit.php
Modify /tracking/admin/fetch_genderit.php to validate and sanitize user input
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules
🧯 If You Can't Patch
- Restrict access to /tracking/admin/fetch_genderit.php using IP whitelisting or authentication
- Implement database-level controls with minimal necessary permissions
🔍 How to Verify
Check if Vulnerable:
Test the /tracking/admin/fetch_genderit.php endpoint with SQL injection payloads in the 'request' parameterCheck Version:
Check the system version in the application interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed SQL injection attempts
- Access to fetch_genderit.php with suspicious parameters
Network Indicators:
- HTTP requests to /tracking/admin/fetch_genderit.php containing SQL keywords
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/tracking/admin/fetch_genderit.php" AND (request CONTAINS "UNION" OR request CONTAINS "SELECT" OR request CONTAINS "INSERT" OR request CONTAINS "DELETE")