CVE-2024-8710
📋 TL;DR
This critical SQL injection vulnerability in code-projects Inventory Management 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in the /model/viewProduct.php file. Remote attackers can potentially access, modify, or delete database contents. All users running the vulnerable version are affected.
💻 Affected Systems
- code-projects Inventory Management
📦 What is this software?
Inventory Management by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via 'id' parameter is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative inventory management software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to ensure 'id' parameter contains only numeric values
Modify /model/viewProduct.php to validate $_GET['id'] or $_POST['id'] is numeric before processing
Implement Parameterized Queries
allReplace direct SQL concatenation with prepared statements
Replace: $sql = "SELECT * FROM products WHERE id = " . $_GET['id'];
With: $stmt = $pdo->prepare("SELECT * FROM products WHERE id = ?"); $stmt->execute([$_GET['id']]);
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the /model/viewProduct.php endpoint
- Restrict network access to the application using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Test the /model/viewProduct.php endpoint with SQL injection payloads like: /model/viewProduct.php?id=1' OR '1'='1Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Test with SQL injection payloads after implementing fixes to ensure they are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to /model/viewProduct.php with varying id parameters
- Database queries with suspicious patterns
Network Indicators:
- HTTP requests to /model/viewProduct.php containing SQL keywords like UNION, SELECT, OR, --
SIEM Query:
source="web_logs" AND uri="/model/viewProduct.php" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR*" OR query="*--*")