CVE-2024-2067: Computer Inventory System SQLi Vulnerability

CVE-2024-2067 Overview

A critical SQL injection vulnerability has been identified in SourceCodester Computer Inventory System version 1.0. This vulnerability affects the /endpoint/delete-computer.php file, where improper handling of the computer parameter allows attackers to inject malicious SQL statements. The vulnerability can be exploited remotely without authentication, potentially leading to unauthorized database access, data manipulation, and complete system compromise.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially resulting in complete database compromise, data exfiltration, data modification, and unauthorized administrative access to the Computer Inventory System.

Affected Products

• SourceCodester Computer Inventory System 1.0
• Remyandrade Computer Inventory System 1.0

Discovery Timeline

• 2024-03-01 - CVE CVE-2024-2067 published to NVD
• 2024-12-17 - Last updated in NVD database

Technical Details for CVE-2024-2067

Vulnerability Analysis

This SQL injection vulnerability exists in the delete-computer.php endpoint of the SourceCodester Computer Inventory System. The application fails to properly sanitize user-supplied input in the computer parameter before incorporating it into SQL queries. This allows attackers to manipulate the SQL query structure by injecting malicious SQL code through the vulnerable parameter.

The vulnerability is classified as CWE-89 (SQL Injection), a common and well-documented class of web application vulnerabilities. Because the attack can be initiated remotely without any authentication requirements or user interaction, the potential for exploitation is significant. Successful exploitation could allow an attacker to bypass authentication mechanisms, retrieve sensitive data from the database, modify or delete records, and potentially gain full control over the underlying database server.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and parameterized queries in the delete-computer.php file. The application directly concatenates user-supplied input from the computer parameter into SQL statements without sanitization or the use of prepared statements. This coding practice violates secure development guidelines and allows attackers to escape the intended query context and inject their own SQL commands.

Attack Vector

The attack vector for CVE-2024-2067 is network-based, allowing remote exploitation. An attacker can craft malicious HTTP requests targeting the /endpoint/delete-computer.php endpoint with specially crafted values for the computer parameter. The injected SQL payload is then executed by the database server in the context of the application's database connection.

The exploitation does not require any privileges or authentication, and no user interaction is necessary. An attacker simply needs network access to the vulnerable application endpoint. The exploit has been publicly disclosed, meaning proof-of-concept code is available for reference. See the GitHub PoC Repository for technical details on the exploitation mechanism.

Detection Methods for CVE-2024-2067

Indicators of Compromise

• Unusual or malformed requests to /endpoint/delete-computer.php containing SQL syntax characters such as single quotes, double dashes, semicolons, or UNION statements
• Database error messages exposed in HTTP responses indicating SQL syntax errors
• Unexpected database queries in logs, particularly those involving system tables or attempting data extraction
• Evidence of bulk data access or exfiltration from the computer inventory database

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to the vulnerable endpoint
• Enable detailed logging for the /endpoint/delete-computer.php endpoint and monitor for anomalous parameter values
• Implement database activity monitoring to detect unusual query patterns or unauthorized access attempts
• Use security scanning tools to identify SQL injection vulnerabilities in the application

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL injection payloads targeting the computer parameter
• Configure database audit logging to track all queries executed against the computer inventory database
• Set up alerts for multiple failed or malformed requests from the same source IP address
• Review application logs for database connection errors or unexpected query execution patterns

How to Mitigate CVE-2024-2067

Immediate Actions Required

• Restrict network access to the Computer Inventory System to trusted IP addresses or internal networks only
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Disable or remove the vulnerable /endpoint/delete-computer.php endpoint if the delete functionality is not essential
• Conduct a security review of the entire application for similar SQL injection vulnerabilities

Patch Information

No official vendor patch is currently available for this vulnerability. Organizations using the SourceCodester Computer Inventory System should implement the workarounds listed below and consider migrating to a more secure inventory management solution. Monitor the VulDB advisory for updates on potential patches or fixes.

Workarounds

• Implement input validation to sanitize the computer parameter, rejecting any input containing SQL metacharacters
• Modify the application code to use parameterized queries or prepared statements for all database operations
• Add authentication requirements to the /endpoint/delete-computer.php endpoint to prevent anonymous access
• Deploy network-level access controls to limit exposure of the vulnerable application to trusted users only

# Example: Apache mod_security rule to block SQL injection attempts
SecRule ARGS:computer "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'SQL Injection attempt detected in computer parameter',\
    log,\
    severity:CRITICAL"