CVE-2024-5774: Stock Management System SQLi Vulnerability

CVE-2024-5774 Overview

A critical SQL injection vulnerability has been discovered in SourceCodester Stock Management System version 1.0. The vulnerability exists in the index.php file within the Login component, where improper handling of the username and password parameters allows attackers to inject malicious SQL queries. This flaw can be exploited remotely without authentication, potentially allowing unauthorized access to the underlying database and compromising the integrity of the entire system.

Critical Impact

Remote attackers can bypass authentication, extract sensitive data, modify database contents, or potentially gain unauthorized access to the stock management system through SQL injection in the login form.

Affected Products

• SourceCodester Stock Management System 1.0
• Warrendaloyan Stock Management System 1.0
• Login component via index.php

Discovery Timeline

• 2024-06-09 - CVE-2024-5774 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5774

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the login functionality of the Stock Management System. The application fails to properly sanitize user-supplied input in the username and password fields before incorporating them into SQL queries. This allows an attacker to manipulate the query logic by injecting malicious SQL statements through the login form.

The vulnerability is particularly dangerous because it exists at the authentication entry point of the application. Successful exploitation could allow an attacker to bypass authentication entirely, extract sensitive data from the database, modify or delete records, or potentially execute administrative operations depending on the database user privileges.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the login handling code. The index.php file in the Login component directly concatenates user input into SQL statements without proper sanitization or the use of prepared statements. This is a classic example of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Attack Vector

The attack can be launched remotely over the network against the application's login page. An attacker does not require any prior authentication or special privileges to exploit this vulnerability. By crafting malicious input containing SQL syntax in either the username or password fields, an attacker can manipulate the backend SQL query to:

1. Bypass authentication by injecting conditions that always evaluate to true
2. Extract data from the database using UNION-based or error-based techniques
3. Enumerate database structure and sensitive information
4. Potentially modify or delete database records

The exploit has been publicly disclosed, increasing the risk of widespread exploitation. Technical details can be found in the GitHub Issue #43 Discussion and VulDB CVE Analysis #267457.

Detection Methods for CVE-2024-5774

Indicators of Compromise

• Unusual or malformed login attempts containing SQL syntax characters such as single quotes ('), double dashes (--), or semicolons (;) in username or password fields
• Database error messages in application logs indicating SQL syntax errors
• Unexpected successful login events for unknown or administrative accounts
• Database query logs showing abnormal SELECT, UNION, or OR-based injection patterns
• Web server access logs with suspicious POST requests to index.php containing encoded SQL payloads

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in form submissions
• Implement database activity monitoring to identify unusual query patterns or unauthorized data access
• Configure intrusion detection systems (IDS) with signatures for common SQL injection attack strings
• Enable detailed logging on the web server and database to capture suspicious authentication attempts

Monitoring Recommendations

• Monitor authentication logs for repeated failed login attempts with unusual character patterns
• Set up alerts for database queries originating from the web application that contain UNION, OR 1=1, or comment syntax
• Review web application firewall logs for blocked requests targeting the login endpoint
• Implement real-time monitoring of database user activity and privilege escalation attempts

How to Mitigate CVE-2024-5774

Immediate Actions Required

• Take the Stock Management System offline or restrict access to trusted networks until patched
• Implement Web Application Firewall (WAF) rules to filter SQL injection attempts on the login endpoint
• Review database logs for signs of prior exploitation and assess potential data breach
• Reset all user credentials and database passwords as a precautionary measure
• Apply input validation at the network level using reverse proxy or load balancer rules

Patch Information

No official vendor patch has been released at the time of this publication. The SourceCodester Stock Management System 1.0 remains vulnerable. Organizations should consider the following:

• Contact the vendor (SourceCodester/Warrendaloyan) to request a security patch
• Review VulDB #267457 for updates on patch availability
• Consider migrating to an alternative stock management solution with better security practices
• If the source code is available, manually implement prepared statements and parameterized queries in the login functionality

Workarounds

• Implement server-side input validation to reject login attempts containing SQL metacharacters such as single quotes, semicolons, and SQL keywords
• Deploy a Web Application Firewall with SQL injection protection enabled in front of the application
• Restrict database user privileges to minimum required permissions (principle of least privilege)
• Place the application behind a VPN or IP whitelist to limit exposure to trusted users only
• Add rate limiting on the login endpoint to slow down automated exploitation attempts

# Example ModSecurity WAF rule to block SQL injection in login form
SecRule ARGS:username|ARGS:password "@rx (?i)(\'|\"|\-\-|;|union|select|insert|update|delete|drop|exec|xp_)" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in login parameters',\
    tag:'CVE-2024-5774'"