CVE-2024-8565
📋 TL;DR
This critical SQL injection vulnerability in SourceCodesters Clinics Patient Management System 2.0 allows attackers to execute arbitrary SQL commands via the /print_diseases.php endpoint. Remote attackers can potentially access, modify, or delete sensitive patient data. All systems running the vulnerable version are affected.
💻 Affected Systems
- SourceCodesters Clinics Patient Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to patient data theft, system takeover, or data destruction
Likely Case
Unauthorized access to sensitive patient records and medical information
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Public exploit code available on GitHub, requires minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to /print_diseases.php to sanitize disease/from/to inputs
Modify print_diseases.php to use prepared statements with parameterized queries
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in disease/from/to parameters
🧯 If You Can't Patch
- Block external access to /print_diseases.php endpoint at network perimeter
- Implement strict database user permissions with read-only access where possible
🔍 How to Verify
Check if Vulnerable:
Test /print_diseases.php with SQL injection payloads in disease, from, or to parametersCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Verify parameterized queries are implemented and SQL injection attempts are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests to /print_diseases.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/print_diseases.php" AND (param="disease" OR param="from" OR param="to") AND (content="UNION" OR content="SELECT" OR content="INSERT" OR content="DELETE")