CVE-2024-7732: Secom Dr.id Attendance System SQLi Flaw

CVE-2024-7732 Overview

CVE-2024-7732 is a SQL injection vulnerability in the Dr.ID Access Control System developed by SECOM. The product fails to properly validate a specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands. Successful exploitation lets attackers read, modify, and delete database contents without credentials or user interaction. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command and was disclosed through Taiwan CERT.

Critical Impact
Unauthenticated remote attackers can fully compromise database confidentiality, integrity, and availability through crafted SQL payloads delivered over the network.

Affected Products

SECOM Dr.ID Access Control System (Attendance System)
All versions prior to the vendor-supplied fix
Deployments exposing the vulnerable page parameter to untrusted networks

Discovery Timeline

2024-08-14 - CVE-2024-7732 published to NVD
2024-10-03 - Last updated in NVD database

Technical Details for CVE-2024-7732

Vulnerability Analysis

The vulnerability resides in a web-facing component of the Dr.ID Access Control System that accepts user-controlled input through a specific page parameter. The application concatenates this parameter into a SQL query without parameterization or input sanitization. Attackers can append SQL syntax to the parameter to alter query logic, extract arbitrary data, or perform destructive operations.

Because the affected endpoint does not enforce authentication, exploitation requires no credentials. Network-based attackers can interact with the vulnerable parameter using standard HTTP requests. The Dr.ID system typically stores employee identity data, attendance records, and access credentials, making the database a high-value target.

An EPSS score of 1.33% indicates moderate predicted exploitation likelihood, placing this issue in the 80th percentile of vulnerabilities. The flaw is documented in the Taiwan CERT Security Advisory.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The application builds SQL statements by directly embedding the page parameter into query strings rather than using prepared statements or parameterized queries. No allow-list validation or type enforcement is applied before the value reaches the database driver.

Attack Vector

An attacker sends an HTTP request to the vulnerable endpoint with a manipulated page parameter containing SQL syntax. Payloads can use UNION-based extraction to read tables, boolean-based blind techniques to enumerate data, or stacked queries to issue INSERT, UPDATE, and DELETE statements. No authentication, user interaction, or local access is required.

For technical details, refer to the vendor and CERT publications. No public proof-of-concept exploit code is currently available.

Detection Methods for CVE-2024-7732

Indicators of Compromise

HTTP requests to Dr.ID Access Control System pages containing SQL metacharacters such as ', --, UNION, SELECT, OR 1=1, or hex-encoded variants in the page parameter
Unexpected database errors or 500-series HTTP responses logged by the Dr.ID web server
Unauthorized modifications to attendance, employee, or access-control tables
Outbound database connections or queries from the Dr.ID host outside normal operational patterns

Detection Strategies

Inspect web server access logs for query strings targeting Dr.ID endpoints with SQL keywords or encoded special characters
Deploy a Web Application Firewall (WAF) with SQL injection signatures in front of the Dr.ID system
Enable database-level auditing to record queries originating from the Dr.ID service account and alert on schema-altering statements

Monitoring Recommendations

Forward Dr.ID web and database logs to a centralized log platform and correlate spikes in error responses with parameter anomalies
Monitor for unauthenticated requests reaching internal-facing Dr.ID endpoints from untrusted network segments
Alert on bulk read operations against employee credential and access-control tables

How to Mitigate CVE-2024-7732

Immediate Actions Required

Restrict network access to the Dr.ID Access Control System so only trusted management networks can reach its web interface
Apply the vendor-provided fix from SECOM as soon as it is available for your deployment
Review database audit logs for evidence of prior exploitation since the system has been deployed
Rotate database credentials and any secrets potentially exposed through the vulnerable database

Patch Information

SECOM has issued advisories through Taiwan CERT. Administrators should obtain the latest fixed build directly from SECOM and follow the upgrade guidance in the Taiwan CERT Security Notice. No NVD-listed vendor advisory URL is published at this time beyond the CERT references.

Workarounds

Place the Dr.ID system behind a WAF configured to block SQL injection patterns targeting the affected page parameter
Limit the Dr.ID database service account to least-privilege permissions, removing rights to alter schema or drop tables
Segment the Dr.ID host on an isolated VLAN with strict ingress filtering until the patch is applied

bash

# Example: restrict access to the Dr.ID web interface to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP