CVE-2024-3464: Laundry Shop Management System SQLi Flaw

CVE-2024-3464 Overview

A critical SQL Injection vulnerability has been discovered in SourceCodester Laundry Management System version 1.0. This vulnerability affects the laporan_filter function within the file /application/controller/Pelanggan.php. The improper handling of the jeniskelamin parameter allows attackers to inject malicious SQL commands, potentially leading to complete database compromise, data theft, and unauthorized system access.

Critical Impact

Remote attackers can exploit this SQL Injection vulnerability without authentication to extract sensitive customer data, modify database records, or potentially execute arbitrary commands on the underlying database server.

Affected Products

• SourceCodester Laundry Management System 1.0
• Oretnom23 Laundry Shop Management System 1.0

Discovery Timeline

• 2024-04-08 - CVE-2024-3464 published to NVD
• 2025-01-17 - Last updated in NVD database

Technical Details for CVE-2024-3464

Vulnerability Analysis

This SQL Injection vulnerability exists in the laporan_filter function of the Laundry Management System. The application fails to properly sanitize user-supplied input passed through the jeniskelamin (gender) parameter before incorporating it into SQL queries. This lack of input validation allows attackers to manipulate the query structure and execute arbitrary SQL commands against the backend database.

The vulnerable endpoint is accessible remotely without requiring any authentication, making exploitation straightforward for attackers. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which is one of the most common and dangerous web application security flaws.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the laporan_filter function within /application/controller/Pelanggan.php. The jeniskelamin parameter is directly concatenated into SQL queries without proper sanitization or use of prepared statements. This allows specially crafted input containing SQL syntax to alter the intended query logic.

Attack Vector

The attack vector is network-based, allowing remote exploitation without user interaction or authentication. An attacker can send a malicious HTTP request to the vulnerable endpoint, manipulating the jeniskelamin parameter with SQL injection payloads. Successful exploitation could allow the attacker to:

• Extract sensitive customer information including personal details and transaction records
• Modify or delete database records
• Bypass authentication mechanisms
• Potentially escalate to remote code execution depending on database configuration

Technical details and proof-of-concept information are available in the GitHub CVE PoC repository.

Detection Methods for CVE-2024-3464

Indicators of Compromise

• Unusual SQL error messages in application or web server logs indicating injection attempts
• Unexpected database queries containing SQL keywords like UNION, SELECT, DROP, or -- in access logs
• Anomalous requests to /application/controller/Pelanggan.php with suspicious parameter values
• Database access patterns showing bulk data extraction or unauthorized administrative queries

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests
• Implement database activity monitoring to identify anomalous query patterns and unauthorized data access
• Configure application logging to capture all requests to the vulnerable Pelanggan.php controller
• Use SentinelOne Singularity to monitor for post-exploitation activities on systems hosting the application

Monitoring Recommendations

• Monitor HTTP request logs for the jeniskelamin parameter containing SQL syntax characters such as single quotes, semicolons, or comment indicators
• Set up alerts for database errors that may indicate failed injection attempts
• Track unusual data exfiltration patterns from the database server
• Review access logs for repeated requests to the vulnerable endpoint from the same source

How to Mitigate CVE-2024-3464

Immediate Actions Required

• Restrict network access to the Laundry Management System to trusted IP addresses only
• Consider temporarily disabling the vulnerable laporan_filter functionality until a fix is applied
• Implement WAF rules to filter SQL injection patterns targeting the jeniskelamin parameter
• Audit database access logs for any signs of prior exploitation

Patch Information

No official vendor patch has been identified in the available references. Organizations using SourceCodester Laundry Management System 1.0 should contact the vendor (oretnom23) for remediation guidance or consider implementing the code-level fixes described in the workarounds section. Additional technical information can be found at VulDB.

Workarounds

• Implement prepared statements (parameterized queries) for all database interactions in the affected laporan_filter function
• Apply strict input validation to the jeniskelamin parameter, restricting it to expected values only
• Deploy a reverse proxy or WAF with SQL injection detection rules in front of the application
• If the reporting functionality is not essential, disable or remove the vulnerable endpoint entirely
• Implement database user privilege restrictions to limit the impact of successful SQL injection

# Example: Restrict database user privileges (MySQL)
REVOKE ALL PRIVILEGES ON laundry_db.* FROM 'app_user'@'localhost';
GRANT SELECT, INSERT, UPDATE ON laundry_db.customers TO 'app_user'@'localhost';
GRANT SELECT, INSERT, UPDATE ON laundry_db.orders TO 'app_user'@'localhost';
FLUSH PRIVILEGES;