CVE-2024-8348
📋 TL;DR
This critical vulnerability allows remote attackers to execute arbitrary SQL commands via the delete_category function in SourceCodester Computer Laboratory Management System 1.0. Attackers can manipulate the 'id' parameter to inject malicious SQL, potentially compromising the database. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Computer Laboratory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion; potential privilege escalation to system-level access.
Likely Case
Unauthorized data access, data exfiltration, or database manipulation leading to system disruption.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub; SQL injection is well-understood with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing input validation and parameterized queries manually.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the 'id' parameter to only accept expected values.
Modify /classes/Master.php to validate and sanitize the id parameter before SQL execution
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Configure WAF to block requests containing SQL injection patterns to /classes/Master.php?f=delete_category
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database access attempts
🔍 How to Verify
Check if Vulnerable:
Check if running version 1.0 of Computer Laboratory Management System; test the /classes/Master.php?f=delete_category endpoint with SQL injection payloads.Check Version:
Check system documentation or admin panel for version information; examine source code headers.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed; check that input validation is implemented for the id parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed delete_category requests
- Requests with SQL keywords in id parameter
Network Indicators:
- HTTP requests to /classes/Master.php?f=delete_category with suspicious parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/classes/Master.php" AND query="f=delete_category" AND (id CONTAINS "'" OR id CONTAINS "--" OR id CONTAINS "UNION")