Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
A critical vulnerability has been discovered in code-projects Restaurant Reservation System version 1.0. The issue affects the processing of the file index.php, where manipulation of the 'date' argument can lead to SQL injection. This vulnerability can be exploited remotely without requiring user interaction or privileges.
The impact of this vulnerability is severe, with potential for high levels of compromise in confidentiality, integrity, and availability of the affected system. Attackers could potentially: 1. Access, modify, or delete sensitive data in the database 2. Execute unauthorized database commands 3. Bypass authentication mechanisms 4. Escalate privileges within the application 5. Potentially gain control over the underlying server The CVSS v3.1 base score of 9.8 (Critical) indicates that this vulnerability poses a significant risk to the organization if left unaddressed.
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
As of the latest information provided, there is no mention of an available patch for this vulnerability. The affected version is Restaurant Reservation System 1.0, and users should monitor for updates from code-projects for a patched version.
While waiting for an official patch, consider the following mitigation strategies: 1. Implement input validation and sanitization for all user inputs, especially the 'date' parameter in index.php. 2. Use parameterized queries or prepared statements to prevent SQL injection. 3. Apply the principle of least privilege to database accounts used by the application. 4. Enable SQL query logging and monitor for suspicious activities. 5. Consider temporarily disabling the affected functionality if possible without disrupting critical business operations. 6. Implement a Web Application Firewall (WAF) to filter out malicious requests. 7. Regularly update and patch the underlying server and database systems. 8. Conduct a thorough security review of the application to identify and address any similar vulnerabilities.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2024-9085
A CVSS base score of 7.3 has been assigned.
Feedly found the first article mentioning CVE-2024-9085. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 16.3%)
A CVSS base score of 9.8 has been assigned.