CVE-2024-8343: Movie Rating System SQL Injection Flaw

CVE-2024-8343 Overview

A SQL injection vulnerability has been identified in SourceCodester Sentiment Based Movie Rating System version 1.0. The vulnerability exists in the User Registration Handler component, specifically within the /classes/Users.php?f=save_client endpoint. Attackers can exploit this flaw by manipulating the email parameter to inject malicious SQL queries, potentially compromising the underlying database and gaining unauthorized access to sensitive information.

Critical Impact

This SQL injection vulnerability allows remote, unauthenticated attackers to manipulate database queries through the user registration functionality, potentially leading to data exfiltration, data manipulation, or complete database compromise.

Affected Products

• SourceCodester Sentiment Based Movie Rating System 1.0
• Applications using oretnom23 sentiment_based_movie_rating_system component

Discovery Timeline

• 2024-08-30 - CVE-2024-8343 published to NVD
• 2024-09-04 - Last updated in NVD database

Technical Details for CVE-2024-8343

Vulnerability Analysis

The vulnerability resides in the user registration functionality of the Sentiment Based Movie Rating System. The application fails to properly sanitize user-supplied input in the email parameter before incorporating it into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL statements that execute in the context of the database user, potentially bypassing authentication, extracting sensitive data, or modifying database contents.

The affected endpoint /classes/Users.php?f=save_client processes client registration requests but does not implement prepared statements or parameterized queries. When a user submits registration data, the email field is directly concatenated into the SQL query string without proper escaping or validation.

Root Cause

The root cause of this vulnerability is improper input validation and the use of unsanitized user input directly in SQL query construction. The application's User Registration Handler does not implement parameterized queries or prepared statements when processing the email parameter, making it susceptible to SQL injection attacks. This is a classic example of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can remotely target the vulnerable endpoint by crafting a malicious HTTP request to /classes/Users.php?f=save_client with a specially crafted email parameter containing SQL injection payloads.

The exploitation process involves sending a POST request to the registration endpoint with malicious SQL syntax embedded in the email field. Common attack techniques include UNION-based injection to extract data from other tables, time-based blind injection for data exfiltration when direct output is not visible, and boolean-based blind injection to infer information through application behavior changes.

For technical proof-of-concept details, refer to the GitHub SQL Injection PoC published by the security researcher.

Detection Methods for CVE-2024-8343

Indicators of Compromise

• Unusual or malformed requests to /classes/Users.php?f=save_client containing SQL syntax characters such as single quotes, semicolons, or UNION keywords
• Database error messages appearing in application logs or HTTP responses indicating SQL syntax errors
• Unexpected database queries or query execution times in database audit logs
• Anomalous patterns in user registration attempts with email addresses containing SQL meta-characters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the email parameter of registration requests
• Monitor web server access logs for requests to /classes/Users.php containing suspicious characters or encoding patterns
• Enable database query logging and alert on queries with unexpected syntax or execution patterns
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Configure real-time alerting for any requests containing SQL injection indicators targeting the User Registration Handler endpoint
• Implement database activity monitoring to detect unauthorized data access or modification attempts
• Review application logs regularly for signs of automated scanning or exploitation attempts against PHP endpoints
• Monitor for unusual database connection patterns or query volumes that may indicate active exploitation

How to Mitigate CVE-2024-8343

Immediate Actions Required

• Restrict access to the vulnerable /classes/Users.php endpoint until a patch can be applied
• Deploy WAF rules specifically blocking SQL injection attempts against the user registration functionality
• Consider disabling new user registration temporarily if the feature is not critical to operations
• Audit database access logs for any signs of prior exploitation

Patch Information

No official vendor patch has been released for this vulnerability at the time of publication. Users of the Sentiment Based Movie Rating System should check the SourceCodester website for security updates. Given that this is an open-source project, organizations using this software should consider implementing their own code-level fixes or migrating to a more actively maintained alternative.

For additional technical information about this vulnerability, refer to the VulDB entry #276222.

Workarounds

• Implement prepared statements or parameterized queries in the Users.php file to properly handle user input in the email parameter
• Add server-side input validation to reject email values containing SQL meta-characters before processing
• Deploy a reverse proxy or WAF in front of the application with SQL injection protection enabled
• Limit database user permissions to reduce the impact of successful SQL injection attacks by applying the principle of least privilege

# Example: Restricting access to vulnerable endpoint via Apache .htaccess
<Files "Users.php">
    Order Deny,Allow
    Deny from all
    # Allow only from trusted internal networks if needed
    Allow from 192.168.1.0/24
</Files>