CVE-2024-5976: Employee Gate Pass Logging System SQLi Flaw

CVE-2024-5976 Overview

A critical SQL injection vulnerability has been identified in the SourceCodester Employee and Visitor Gate Pass Logging System version 1.0. The vulnerability exists in the log_employee function within the file /classes/Master.php?f=log_employee, where improper handling of the employee_code parameter allows attackers to inject malicious SQL statements. This flaw enables remote attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to bypass authentication, extract sensitive employee and visitor data, modify database records, or potentially escalate privileges within the affected system.

Affected Products

• SourceCodester Employee and Visitor Gate Pass Logging System 1.0
• oretnom23 employee_and_visitor_gate_pass_logging_system 1.0

Discovery Timeline

• June 13, 2024 - CVE-2024-5976 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-5976

Vulnerability Analysis

This SQL injection vulnerability affects the log_employee function in the Employee and Visitor Gate Pass Logging System. The application fails to properly sanitize or parameterize user-supplied input through the employee_code parameter before incorporating it into SQL queries. When a user submits data through the logging endpoint at /classes/Master.php?f=log_employee, the application directly concatenates the employee_code value into a database query without adequate validation or escaping.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which represents one of the most prevalent and dangerous web application security flaws. Successful exploitation allows attackers to execute arbitrary SQL commands against the backend database, potentially compromising the confidentiality, integrity, and availability of stored data.

Root Cause

The root cause of this vulnerability is the lack of input validation and the use of unsanitized user input in SQL query construction. The log_employee function directly incorporates the employee_code parameter into database queries without implementing prepared statements, parameterized queries, or proper input sanitization. This design flaw allows malicious actors to inject SQL metacharacters and commands that alter the intended query logic.

Attack Vector

The attack can be launched remotely over the network without requiring authentication. An attacker can craft a malicious HTTP request to the vulnerable endpoint, inserting SQL injection payloads within the employee_code parameter. The attack requires no user interaction and can be automated, making it particularly dangerous for exposed systems.

The exploitation involves sending specially crafted requests to the /classes/Master.php?f=log_employee endpoint with malicious SQL syntax in the employee_code field. Common techniques include UNION-based injection to extract data from other tables, boolean-based blind injection to infer database contents, and time-based blind injection for scenarios where output is not directly visible.

For detailed technical information about this vulnerability, refer to the GitHub CVE Documentation and VulDB Entry #268422.

Detection Methods for CVE-2024-5976

Indicators of Compromise

• Unusual SQL error messages appearing in application logs or error responses
• HTTP requests to /classes/Master.php?f=log_employee containing SQL metacharacters such as single quotes, UNION statements, or comment sequences
• Database query logs showing unexpected queries or access to system tables
• Abnormal database activity patterns including bulk data extraction or unauthorized schema enumeration

Detection Strategies

• Deploy Web Application Firewalls (WAF) configured with SQL injection detection rulesets to identify and block malicious payloads
• Implement application-level logging to capture all requests to the vulnerable Master.php endpoint with full parameter values
• Configure database activity monitoring to alert on queries containing injection patterns or accessing sensitive system tables
• Utilize intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on the web server for all requests to /classes/Master.php and related PHP files
• Monitor database connection logs for failed authentication attempts or syntax errors that may indicate injection testing
• Set up alerts for HTTP requests containing common SQL injection characters and keywords in the employee_code parameter
• Review access logs regularly for patterns of automated scanning or repeated exploitation attempts

How to Mitigate CVE-2024-5976

Immediate Actions Required

• Take the affected Employee and Visitor Gate Pass Logging System offline or restrict network access until remediation is complete
• Implement Web Application Firewall rules to block requests containing SQL injection patterns to the vulnerable endpoint
• Review database logs for any signs of prior exploitation and assess potential data compromise
• Restrict access to the application to trusted internal networks only if continued operation is required

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations using the affected SourceCodester Employee and Visitor Gate Pass Logging System 1.0 should contact the vendor for remediation guidance or consider implementing code-level fixes independently.

For additional vulnerability details, consult the VulDB CTI Entry #268422.

Workarounds

• Implement input validation to sanitize the employee_code parameter, allowing only expected alphanumeric characters
• Modify the source code to use prepared statements or parameterized queries instead of dynamic SQL concatenation
• Deploy a reverse proxy or WAF with SQL injection blocking capabilities in front of the application
• Restrict network access to the application using firewall rules to limit exposure to trusted IP addresses only

# Example WAF rule to block SQL injection patterns (ModSecurity format)
SecRule ARGS:employee_code "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Detected in employee_code parameter'"

# Network-level restriction example (iptables)
iptables -A INPUT -p tcp --dport 80 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP