Exploit
CVE-2024-9327

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 29, 2024 / Updated: 51d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in the Blood Bank System version 1.0 developed by code-projects. This vulnerability affects the /forgot.php file and allows for SQL injection through the manipulation of the useremail argument. The attack can be initiated remotely and does not require user interaction.

Impact

This SQL injection vulnerability can have severe consequences. Given the CVSS v3.1 score of 9.8 (Critical), it indicates that successful exploitation could lead to a complete compromise of the system's confidentiality, integrity, and availability. Attackers could potentially: 1. Access, modify, or delete sensitive information in the database, including patient records and blood bank inventory. 2. Escalate privileges within the system. 3. Execute arbitrary commands on the database server. 4. Potentially gain control over the entire Blood Bank System. The high severity is due to the attack vector being network-accessible, requiring no privileges or user interaction, and having a low attack complexity.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an available patch for this vulnerability. The affected version is Blood Bank System 1.0 by code-projects.

Mitigation

While a patch is not mentioned, the following mitigation steps are recommended: 1. Implement input validation and sanitization for all user inputs, especially the useremail parameter in the /forgot.php file. 2. Use prepared statements or parameterized queries to prevent SQL injection. 3. Apply the principle of least privilege to database accounts used by the application. 4. Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts. 5. Regularly audit and monitor database activities for suspicious queries. 6. Consider upgrading or replacing the Blood Bank System if a secure version becomes available. 7. Limit network access to the application, especially the affected /forgot.php file, if possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9327. See article

Sep 29, 2024 at 8:05 AM / VulDB Recent Entries
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 29, 2024 at 8:05 AM
CVE Assignment

NVD published the first details for CVE-2024-9327

Sep 29, 2024 at 11:15 AM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 30, 2024 at 9:35 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 2, 2024 at 1:00 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 2, 2024 at 3:10 PM
Static CVE Timeline Graph

Affected Systems

Code-projects/blood_bank_system
+null more

Exploits

https://github.com/Lynn1236-cell/cve1/blob/main/sql3.md
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE-2024-9327 Exploit
CVE Id : CVE-2024-9327 Published Date: 2024-10-02T12:57:00+00:00 A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/Lynn1236-cell/cve1/blob/main/sql3.md
CVE Alert: CVE-2024-9327 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9327/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9327
CVE Alert: CVE-2024-9327
This vulnerability affects unknown code of the file /forgot.php. Affected Endpoints:
CVE-2024-9327 - Exploits & Severity - Feedly
CVE info copied to clipboard The manipulation of the argument useremail leads to sql injection.
CVE-2024-9327
Medium Severity Description A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9327
See 8 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI