CVE-2024-12918 Overview
CVE-2024-12918 is a SQL injection vulnerability in Agito Computer Health4All. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. Authenticated attackers with low privileges can inject malicious SQL statements through the application over the network. Successful exploitation compromises the confidentiality, integrity, and availability of the backend database.
The issue affects all versions of Health4All released before 10.01.2025. The vulnerability was published to the National Vulnerability Database (NVD) on February 24, 2025 by the Turkish national CSIRT (USOM).
Critical Impact
An authenticated remote attacker can read, modify, or destroy database contents in Health4All deployments, potentially exposing sensitive healthcare data.
Affected Products
- Agito Computer Health4All (all versions prior to 10.01.2025)
- Deployments exposing the Health4All web interface to networked users
- Environments where low-privileged application accounts can reach injection sinks
Discovery Timeline
- 2025-02-24 - CVE-2024-12918 published to NVD by USOM (TR-25-0042)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12918
Vulnerability Analysis
The vulnerability is an SQL injection weakness classified under [CWE-89]. Health4All fails to neutralize special characters in user-supplied input before incorporating that input into SQL queries. An attacker with valid low-privilege credentials submits crafted parameters that break out of the intended query context. The database then executes attacker-controlled SQL alongside the original statement.
Because Health4All is a healthcare-oriented application, injected queries can expose personally identifiable information and protected health information. Attackers can also modify records, escalate privileges within the application, or drop tables to cause a denial of service.
Root Cause
The root cause is the concatenation of untrusted input directly into SQL statements without parameterized queries or prepared statements. Input filtering, if present, is insufficient to strip or escape SQL metacharacters such as single quotes, semicolons, and comment sequences. This design flaw allows attacker input to be interpreted as SQL syntax rather than data.
Attack Vector
The attack vector is network-based and requires low-privileged authentication. No user interaction is required. An attacker sends HTTP requests containing malicious payloads to vulnerable endpoints of the Health4All application. The injected SQL executes with the privileges of the database user configured for the application, which is typically broad in healthcare deployments.
No verified proof-of-concept code has been published in public exploit databases. The vulnerability is described in the USOM advisory referenced in USOM Advisory TR-25-0042 and the Siber Güvenlik Notification TR-25-0042.
Detection Methods for CVE-2024-12918
Indicators of Compromise
- HTTP request parameters containing SQL metacharacters such as ', --, ;, UNION SELECT, or OR 1=1 targeting Health4All endpoints
- Database error messages returned in HTTP responses referencing SQL syntax failures
- Unusual outbound data volumes from the Health4All application server after authenticated sessions
- Unexpected access patterns from low-privileged Health4All user accounts querying tables outside their normal scope
Detection Strategies
- Deploy a web application firewall with SQL injection signatures in blocking mode in front of Health4All
- Enable database query logging and alert on statements containing UNION, INFORMATION_SCHEMA, or stacked queries originating from the application service account
- Correlate authentication logs with anomalous query volumes to identify compromised low-privilege accounts
- Review application logs for HTTP 500 errors clustered around specific endpoints, which often indicate injection probing
Monitoring Recommendations
- Monitor for spikes in failed SQL queries generated by the Health4All application account
- Alert on schema enumeration attempts against INFORMATION_SCHEMA or system catalogs
- Track authenticated session activity that reads large volumes of patient records within short time windows
- Forward Health4All and database logs to a centralized SIEM for cross-source correlation
How to Mitigate CVE-2024-12918
Immediate Actions Required
- Upgrade Health4All to the vendor-supplied release dated 10.01.2025 or later
- Restrict network access to the Health4All application to trusted clinical networks only
- Rotate credentials for all Health4All application users and the backing database account
- Audit database activity logs for the period preceding the patch to identify prior exploitation
Patch Information
Agito Computer has addressed CVE-2024-12918 in Health4All versions released on or after 10.01.2025. Administrators should contact the vendor directly for the patched build and follow the guidance in USOM Advisory TR-25-0042. Verify the patched version in a staging environment before production rollout.
Workarounds
- Place a web application firewall in front of Health4All with SQL injection rules enabled if patching cannot be performed immediately
- Enforce least-privilege on the database account used by Health4All so injected queries cannot access unrelated schemas
- Disable or remove unused Health4All application accounts to reduce the authenticated attack surface
- Segment the Health4All server so that a database compromise cannot pivot into other clinical systems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
