Exploit
CVE-2024-9008

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 19, 2024 / Updated: 2mo ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in SourceCodester Best Online News Portal 1.0. The vulnerability affects the Comment Section component, specifically in the /news-details.php file. This issue allows for SQL injection through the manipulation of the 'name' argument. The attack can be initiated remotely and does not require user interaction.

Impact

This SQL injection vulnerability can lead to unauthorized access to the database, potentially allowing attackers to read, modify, or delete sensitive information. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), with high impacts on confidentiality, integrity, and availability. The attack complexity is low, and it can be executed over the network with no privileges required and no user interaction. This makes it extremely easy for attackers to exploit, posing a severe risk to the affected systems.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an available patch for this vulnerability. The security team should monitor for updates from SourceCodester regarding a fix for the Best Online News Portal 1.0 software.

Mitigation

Until a patch is available, consider the following mitigation strategies: 1. Implement input validation and sanitization for all user inputs, especially in the Comment Section of /news-details.php. 2. Use parameterized queries or prepared statements to prevent SQL injection. 3. Apply the principle of least privilege to the database user used by the application. 4. Consider temporarily disabling the comment feature if it's not critical to operations. 5. Implement web application firewall (WAF) rules to detect and block SQL injection attempts. 6. Regularly monitor database logs for suspicious activities. 7. Keep the Best Online News Portal software and all associated components up to date with the latest security patches when they become available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9008. See article

Sep 19, 2024 at 11:11 PM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 19, 2024 at 11:11 PM
CVE Assignment

NVD published the first details for CVE-2024-9008

Sep 19, 2024 at 11:15 PM
CVSS

A CVSS base score of 6.3 has been assigned.

Sep 19, 2024 at 11:20 PM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Sep 20, 2024 at 10:03 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 20, 2024 at 5:06 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Sep 20, 2024 at 7:10 PM
Threat Intelligence Report

CVE-2024-9008 is a critical vulnerability in SourceCodester Best Online News Portal 1.0, with a CVSS score of 9.8, that allows remote attackers to perform SQL injection via the Comment Section component by manipulating the argument name in /news-details.php. The details provided do not specify whether the vulnerability is being actively exploited in the wild, nor do they mention the availability of proof-of-concept exploits, mitigations, detections, or patches. There is also no information regarding potential downstream impacts on other third-party vendors or technologies. See article

Sep 27, 2024 at 5:36 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 28, 2024 at 9:36 PM / nvd
Static CVE Timeline Graph

Affected Systems

Best_online_news_portal_project/best_online_news_portal
+null more

Exploits

https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-News-Portal-Comment-Blind-SQLi.md
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

@RISK: The Consensus Security Vulnerability Alert: Vol. 24, Num. 38 - SANS Institute
Product: Apache HugeGraph-Server CVSS Score: 0 ** KEV since 2024-09-18 ** NVD: ISC Podcast: CVE-2024-7120 - Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90 are vulnerable to critical os command injection via manipulation of the argument template in the Web Interface component's list_base_config.php file, allowing for remote attacks with publicly disclosed exploit potential (VDB-272451). Product: Ivanti Endpoint Manager Cloud Services Appliance CVSS Score: 9.1 ** KEV since 2024-09-19 ** NVD: ISC Podcast: NVD References: CVE-2024-9043 - Cellopoint's Secure Email Gateway is vulnerable to buffer overflow in authentication allowing remote attackers to crash the process and gain admin privileges.

News

Vulnerability Summary for the Week of September 16, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info CIRCUTOR–CIRCUTOR Q-SMT CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. 2024-09-18 10 CVE-2024-8887 cve-coordination@incibe.es CIRCUTOR–CIRCUTOR Q-SMT An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. 2024-09-18 10 CVE-2024-8888 cve-coordination@incibe.es dragonflyoss–Dragonfly2 Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, “Secret Key”, is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade.
Update Thu Oct 10 06:36:34 UTC 2024
Update Thu Oct 10 06:36:34 UTC 2024
Update Tue Oct 8 14:29:49 UTC 2024
Update Tue Oct 8 14:29:49 UTC 2024
@RISK: The Consensus Security Vulnerability Alert: Vol. 24, Num. 38 - SANS Institute
Product: Apache HugeGraph-Server CVSS Score: 0 ** KEV since 2024-09-18 ** NVD: ISC Podcast: CVE-2024-7120 - Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90 are vulnerable to critical os command injection via manipulation of the argument template in the Web Interface component's list_base_config.php file, allowing for remote attacks with publicly disclosed exploit potential (VDB-272451). Product: Ivanti Endpoint Manager Cloud Services Appliance CVSS Score: 9.1 ** KEV since 2024-09-19 ** NVD: ISC Podcast: NVD References: CVE-2024-9043 - Cellopoint's Secure Email Gateway is vulnerable to buffer overflow in authentication allowing remote attackers to crash the process and gain admin privileges.
US-CERT Vulnerability Summary for the Week of September 16, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
See 10 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI