ExploitCVE-2024-9804
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary
A critical vulnerability has been identified in the Blood Bank System version 1.0 developed by code-projects. The vulnerability affects the file /admin/campsdetails.php and allows for SQL injection through the manipulation of the 'hospital' argument. This vulnerability can be exploited remotely and does not require user interaction.
Impact
The primary impact of this vulnerability is on data confidentiality. If exploited, an attacker could potentially access, modify, or extract sensitive information from the database. This could lead to unauthorized access to patient records, donor information, or other critical data stored in the blood bank system. The integrity and availability of the system do not appear to be directly affected based on the provided CVSS scores.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the current information, there is no mention of an available patch for this vulnerability. The security team should closely monitor for any updates or patches released by code-projects for the Blood Bank System 1.0.
Mitigation
Until a patch is available, the following mitigation steps are recommended: 1. Implement input validation and sanitization for all user inputs, especially for the 'hospital' parameter in the affected file. 2. Use prepared statements or parameterized queries to prevent SQL injection attacks. 3. Apply the principle of least privilege to database accounts used by the application. 4. Consider implementing a Web Application Firewall (WAF) to filter out malicious SQL injection attempts. 5. Regularly audit and monitor database access logs for any suspicious activities. 6. If possible, temporarily restrict access to the affected /admin/campsdetails.php file until a proper fix can be implemented.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-9804. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9804
A CVSS base score of 4.7 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.4%)
A CVSS base score of 4.9 has been assigned.