Exploit
CVE-2024-9326

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 29, 2024 / Updated: 51d ago

010
CVSS 6.9EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in PHPGurukul Online Shopping Portal 2.0, specifically affecting the Admin Panel component. The vulnerability is located in the file /shopping/admin/index.php and allows for SQL injection through manipulation of the username argument. This is a remote attack vector that does not require user interaction.

Impact

This SQL injection vulnerability can have severe consequences. Attackers can potentially: 1. Access, modify, or delete sensitive data in the database 2. Bypass authentication mechanisms 3. Execute administrative operations on the database 4. In some cases, issue commands to the operating system Given the CVSS v3.1 score of 9.8 (Critical) and the high impact on confidentiality, integrity, and availability, this vulnerability poses a significant risk to the entire system's security.

Exploitation

One proof-of-concept exploit is available on hackmd.io. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch for this vulnerability in PHPGurukul Online Shopping Portal 2.0. The security team should closely monitor for any updates or patches released by the vendor.

Mitigation

While waiting for an official patch, consider the following mitigation strategies: 1. Implement input validation and sanitization for all user inputs, especially in the admin panel. 2. Use prepared statements or parameterized queries to prevent SQL injection. 3. Apply the principle of least privilege to database accounts used by the application. 4. Enable SQL injection prevention features in any Web Application Firewall (WAF) you may have. 5. Consider temporarily disabling the affected admin panel if possible, or restricting access to it from trusted IP addresses only. 6. Monitor database and application logs for any suspicious activities or unauthorized access attempts. 7. Keep the PHPGurukul Online Shopping Portal and all associated components up to date with the latest security patches when they become available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9326. See article

Sep 29, 2024 at 8:12 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 29, 2024 at 8:13 AM
CVE Assignment

NVD published the first details for CVE-2024-9326

Sep 29, 2024 at 8:15 AM
CVSS

A CVSS base score of 7.3 has been assigned.

Sep 29, 2024 at 8:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 30, 2024 at 9:35 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 2, 2024 at 1:35 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 2, 2024 at 3:10 PM
Static CVE Timeline Graph

Affected Systems

Phpgurukul/online_shopping_portal
+null more

Exploits

https://hackmd.io/@SeaWind/ryBv7CGCR
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE-2024-9326 Exploit
CVE Id : CVE-2024-9326 Published Date: 2024-10-02T13:33:00+00:00 A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://hackmd.io/@SeaWind/ryBv7CGCR
CVE Alert: CVE-2024-9326 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9326/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9326
CVE Alert: CVE-2024-9326
This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. Affected Endpoints:
CVE-2024-9326
High Severity Description A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9326
CVE-2024-9326
Gravedad 3.1 (CVSS 3.1 Base Score) A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0.
See 8 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI