Exploit
CVE-2024-9094

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 23, 2024 / Updated: 58d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in the Blood Bank System version 1.0 developed by code-projects. The vulnerability affects an unknown portion of code in the file /admin/blood/update/o-.php. The issue stems from improper neutralization of special elements used in an SQL command, commonly known as SQL injection. This vulnerability allows for the manipulation of the 'bloodname' argument, potentially leading to unauthorized SQL operations.

Impact

This vulnerability is classified as critical with a CVSS v3.1 base score of 9.8, indicating a severe risk. The attack can be initiated remotely and requires no user interaction or privileges. It potentially allows attackers to compromise the confidentiality, integrity, and availability of the system, all with high impact. Successful exploitation could lead to unauthorized access to sensitive data, modification of database contents, and potential disruption of service availability. Given the nature of SQL injection, attackers might be able to execute arbitrary SQL commands, potentially leading to full database compromise.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an available patch for this vulnerability. The security team should closely monitor for any updates or patches released by code-projects for the Blood Bank System.

Mitigation

In the absence of a patch, the following mitigation steps are recommended: 1. Implement input validation and sanitization for all user inputs, especially for the 'bloodname' parameter in the affected file. 2. Use prepared statements or parameterized queries instead of dynamic SQL to prevent SQL injection. 3. Apply the principle of least privilege to the database user used by the application. 4. Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts. 5. Regularly audit and review the code, particularly focusing on SQL query construction and user input handling. 6. Consider temporarily disabling or restricting access to the affected file (/admin/blood/update/o-.php) if possible without disrupting critical operations. 7. Monitor system logs for any suspicious activities or unexpected SQL queries. 8. Educate developers about secure coding practices, especially regarding SQL injection prevention.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9094. See article

Sep 23, 2024 at 1:35 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 23, 2024 at 1:36 AM
CVE Assignment

NVD published the first details for CVE-2024-9094

Sep 23, 2024 at 2:15 AM
CVSS

A CVSS base score of 6.3 has been assigned.

Sep 23, 2024 at 2:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 23, 2024 at 9:27 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 27, 2024 at 3:55 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Sep 27, 2024 at 5:11 PM
Static CVE Timeline Graph

Affected Systems

Code-projects/blood_bank_system
+null more

Exploits

https://github.com/ByKevin1/CVE/blob/main/sql1.md
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

Vulnerability Summary for the Week of September 23, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Dover Fueling Solutions (DFS)–ProGauge MAGLINK LX CONSOLE A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands. 2024-09-25 10 CVE-2024-43693 ics-cert@hq.dhs.gov Dover Fueling Solutions (DFS)–ProGauge MAGLINK LX CONSOLE A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands. 2024-09-25 10 CVE-2024-45066 ics-cert@hq.dhs.gov webdevmattcrom–GiveWP Donation Plugin and Fundraising Platform The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like ‘give_title’ and ‘card_address’. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2. 2024-09-28 10 CVE-2024-8353 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com Scriptcase–Scriptcase Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. 2024-09-25 10 CVE-2024-8940 cve-coordination@incibe.es n/a–n/a File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
Update Thu Oct 3 22:28:08 UTC 2024
Update Thu Oct 3 22:28:08 UTC 2024
Vulnerability Summary for the Week of September 23, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Dover Fueling Solutions (DFS)--ProGauge MAGLINK LX CONSOLE A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands. 2024-09-25 10 CVE-2024-43693 ics-cert@hq.dhs.gov Dover Fueling Solutions (DFS)--ProGauge MAGLINK LX CONSOLE A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands. 2024-09-25 10 CVE-2024-45066 ics-cert@hq.dhs.gov webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2. 2024-09-28 10 CVE-2024-8353 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com Scriptcase--Scriptcase Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. 2024-09-25 10 CVE-2024-8940 cve-coordination@incibe.es n/a--n/a File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
CVE-2024-9094 Exploit
CVE Id : CVE-2024-9094 Published Date: 2024-09-27T15:54:00+00:00 A vulnerability classified as critical was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /admin/blood/update/o-.php. The manipulation of the argument bloodname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/ByKevin1/CVE/blob/main/sql1.md
CVE Alert: CVE-2024-9094
This vulnerability affects unknown code of the file /admin/blood/update/o-.php. Everyone that supports the site helps enable new functionality.
See 12 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI