CVE-2024-8346
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Computer Laboratory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'name' parameter in the update_settings_info function. Attackers can potentially read, modify, or delete database contents, including sensitive system data. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Computer Laboratory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, or destruction of all laboratory management data
Likely Case
Unauthorized data access and modification, potentially exposing sensitive laboratory records and user information
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data
🎯 Exploit Status
Public exploit available on GitHub, simple SQL injection requiring minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement parameterized queries or prepared statements in /classes/SystemSettings.php to prevent SQL injection
Modify PHP code to use PDO or mysqli prepared statements for all database queries
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection attempts targeting the vulnerable endpoint
Add WAF rule: Block requests containing SQL keywords targeting /classes/SystemSettings.php?f=update_settings
🧯 If You Can't Patch
- Restrict network access to the application to trusted IP addresses only
- Implement database user with minimal necessary permissions (read-only where possible)
🔍 How to Verify
Check if Vulnerable:
Test the /classes/SystemSettings.php?f=update_settings endpoint with SQL injection payloads in the 'name' parameterCheck Version:
Check application version in admin panel or review source code for version markersVerify Fix Applied:
Attempt SQL injection after implementing parameterized queries and verify database errors no longer occur📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server process
- SQL syntax errors in application logs
- Multiple failed login attempts following SQL errors
Network Indicators:
- HTTP POST requests to /classes/SystemSettings.php containing SQL keywords (SELECT, UNION, etc.)
SIEM Query:
source="web_logs" AND uri="/classes/SystemSettings.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*")