CVE-2024-5362: Hospital Management System SQLi Vulnerability

CVE-2024-5362 Overview

A critical SQL injection vulnerability has been identified in SourceCodester Online Hospital Management System version 1.0. The vulnerability exists in the departmentDoctor.php file where the deptid parameter is not properly sanitized before being used in SQL queries. This allows remote attackers to inject malicious SQL commands and potentially compromise the underlying database, access sensitive patient data, modify records, or execute administrative operations without authorization.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive healthcare data, manipulate database records, and potentially gain unauthorized access to the hospital management system without any authentication requirements.

Affected Products

• Warrendaloyan Online Hospital Management System 1.0
• SourceCodester Online Hospital Management System 1.0

Discovery Timeline

• 2024-05-26 - CVE-2024-5362 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-5362

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the departmentDoctor.php file in the Online Hospital Management System. The application fails to properly sanitize user-supplied input in the deptid parameter before incorporating it into SQL queries. This lack of input validation allows attackers to manipulate the query logic by injecting malicious SQL statements through the parameter.

The vulnerability is network-accessible, meaning attackers can exploit it remotely without requiring any prior authentication or user interaction. Given that this is a healthcare application, successful exploitation could lead to unauthorized access to protected health information (PHI), patient records, doctor assignments, and other sensitive medical data stored in the database.

Root Cause

The root cause of this vulnerability is improper input validation in the departmentDoctor.php file. The deptid parameter is directly concatenated or interpolated into SQL queries without proper sanitization, parameterized queries, or prepared statements. This classic SQL injection pattern occurs when developers trust user input and fail to implement secure coding practices for database interactions.

Attack Vector

The attack can be executed remotely over the network. An attacker can craft malicious HTTP requests containing SQL injection payloads in the deptid parameter. Since no authentication is required, any remote attacker with network access to the application can exploit this vulnerability. The attack could be conducted through direct URL manipulation, automated scanning tools, or custom exploit scripts.

The vulnerability has been publicly disclosed and documented in various security databases, which increases the likelihood of exploitation attempts. Attackers could use this vulnerability to perform various malicious actions including data extraction via UNION-based or blind SQL injection techniques, authentication bypass, data modification, or even command execution if the database is configured with elevated privileges.

Detection Methods for CVE-2024-5362

Indicators of Compromise

• Unusual SQL error messages in application logs referencing departmentDoctor.php
• HTTP requests to departmentDoctor.php containing SQL injection patterns such as single quotes, UNION SELECT statements, or comment sequences
• Database query logs showing malformed or suspicious queries originating from the deptid parameter
• Unexpected data access patterns or bulk data retrieval from patient or department-related tables

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection attempts targeting the deptid parameter
• Implement intrusion detection system (IDS) signatures for common SQL injection payloads in HTTP requests
• Enable detailed logging on the web server and database to capture and analyze suspicious query patterns
• Use database activity monitoring (DAM) solutions to alert on anomalous query behavior

Monitoring Recommendations

• Monitor HTTP access logs for requests to departmentDoctor.php with unusual parameter values or encoding
• Configure database audit logging to track queries executed against sensitive healthcare tables
• Set up alerts for failed login attempts or authentication bypass indicators following SQL injection patterns
• Review application error logs regularly for SQL syntax errors that may indicate exploitation attempts

How to Mitigate CVE-2024-5362

Immediate Actions Required

• Restrict network access to the Online Hospital Management System to trusted IP addresses only until patching is complete
• Implement a web application firewall (WAF) with SQL injection protection rules in front of the vulnerable application
• Review database user permissions and ensure the application connects with least-privilege credentials
• Backup all database content before implementing any changes to preserve data integrity

Patch Information

No official vendor patch has been identified for this vulnerability. The application is developed by SourceCodester as an open-source project. Organizations using this software should consider implementing manual code fixes to address the SQL injection vulnerability. For technical details and community discussion, refer to the GitHub Issue Discussion and VulDB entry #266274.

Workarounds

• Implement parameterized queries or prepared statements in departmentDoctor.php to properly handle the deptid parameter
• Add input validation to ensure the deptid parameter only accepts numeric values as expected
• Deploy a reverse proxy or WAF to filter malicious requests before they reach the application
• Consider replacing this vulnerable application with a more secure hospital management solution that has active security maintenance
• Isolate the application on a network segment with restricted access and enhanced monitoring

# Example WAF rule for ModSecurity to block SQL injection in deptid parameter
SecRule ARGS:deptid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in deptid parameter',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'attack-sqli'"