CVE-2024-29872: Sapplica Sentrifugo SQLi Vulnerability

CVE-2024-29872 Overview

CVE-2024-29872 is a SQL injection vulnerability affecting Sentrifugo 3.2, an open-source Human Resource Management (HRM) application. The vulnerability exists in the employee screening functionality, specifically through the /sentrifugo/index.php/empscreening/add endpoint where the agencyids parameter is vulnerable to SQL injection attacks. Successful exploitation allows a remote attacker to send specially crafted SQL queries to the server and extract all data from the underlying database.

Critical Impact

This SQL injection vulnerability enables unauthenticated remote attackers to extract sensitive HR data including employee personal information, credentials, and potentially compromise the entire database server.

Affected Products

• Sapplica Sentrifugo version 3.2

Discovery Timeline

• 2024-03-21 - CVE-2024-29872 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-29872

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the employee screening module within Sentrifugo's HR management system. The vulnerability stems from improper handling of user-supplied input in the agencyids parameter when processing requests to the employee screening add functionality. When a user submits data through this endpoint, the application fails to properly sanitize or parameterize the input before incorporating it into SQL queries executed against the backend database.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it particularly dangerous. An attacker can exploit this flaw remotely without any prior authentication or user interaction, potentially gaining access to the complete database contents including sensitive employee records, authentication credentials, and other confidential HR data.

Root Cause

The root cause is improper input validation and lack of parameterized queries in the employee screening module. The agencyids parameter value is directly concatenated into SQL statements without proper sanitization, escaping, or the use of prepared statements. This allows attackers to inject arbitrary SQL syntax that gets executed by the database engine with the application's privileges.

Attack Vector

The attack is executed remotely over the network by sending malicious HTTP requests to the /sentrifugo/index.php/empscreening/add endpoint. An attacker crafts a request containing SQL injection payloads within the agencyids parameter. The malicious SQL code bypasses input validation and is executed directly against the database, allowing the attacker to perform unauthorized operations such as extracting data, modifying records, or potentially executing system commands depending on the database configuration.

The vulnerability can be exploited through techniques such as UNION-based injection to combine malicious queries with legitimate ones, error-based injection to extract data through error messages, or blind SQL injection to infer data through true/false responses. For detailed technical information, refer to the INCIBE Security Notice.

Detection Methods for CVE-2024-29872

Indicators of Compromise

• Unusual database queries or errors in application logs originating from the /sentrifugo/index.php/empscreening/add endpoint
• HTTP requests containing SQL syntax characters (single quotes, UNION, SELECT, etc.) in the agencyids parameter
• Unexpected data access patterns or large data exfiltration from the Sentrifugo database
• Web server logs showing requests with encoded SQL injection payloads targeting the employee screening functionality

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests
• Implement database activity monitoring to identify anomalous query patterns and unauthorized data access
• Configure intrusion detection systems (IDS) with signatures for SQL injection attack patterns targeting Sentrifugo endpoints
• Monitor application logs for error messages indicating SQL syntax errors or unexpected query behavior

Monitoring Recommendations

• Enable detailed logging for the Sentrifugo application and underlying database
• Set up alerts for requests containing SQL injection indicators targeting the /empscreening/add endpoint
• Monitor database query execution times and data volumes for signs of data extraction
• Implement real-time log analysis to correlate suspicious web requests with database activity

How to Mitigate CVE-2024-29872

Immediate Actions Required

• Restrict network access to the Sentrifugo application to trusted IP ranges only
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Consider disabling or restricting access to the employee screening module until a patch is applied
• Review database permissions to ensure the application uses least-privilege principles
• Audit database access logs to identify any potential compromise

Patch Information

As of the last NVD update on 2025-01-24, no vendor patch has been officially documented for this vulnerability. Organizations using Sentrifugo 3.2 should monitor the vendor's channels and the INCIBE Security Notice for updates. Consider contacting Sapplica directly for remediation guidance.

Workarounds

• Deploy input validation at the web server or reverse proxy level to filter SQL injection payloads
• Use a WAF configured with strict SQL injection detection rules for the affected endpoint
• Implement network segmentation to limit database server exposure
• Consider running Sentrifugo with a database user that has read-only permissions where possible
• Temporarily disable the employee screening functionality if it is not business-critical

# Example: Apache mod_security rule to block SQL injection in agencyids parameter
SecRule ARGS:agencyids "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked on agencyids parameter'"