Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
A critical vulnerability has been discovered in the Blood Bank Management System version 1.0 developed by fabianros. The vulnerability affects the file member_register.php and allows for SQL injection attacks. The issue stems from improper neutralization of special elements used in SQL commands, specifically in the processing of the fullname, username, password, and email parameters.
This vulnerability could allow remote attackers to execute arbitrary SQL commands on the underlying database. Potential impacts include: 1. Unauthorized access to sensitive data in the blood bank management system. 2. Modification or deletion of critical patient and donor information. 3. Potential escalation of privileges within the application. 4. Compromise of the entire database's integrity and confidentiality. 5. Possible use of the compromised system as a stepping stone for further network intrusion.
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
As of the current information, no specific patch has been mentioned for this vulnerability. Users of the Blood Bank Management System 1.0 should contact the vendor (fabianros) for updates or patching information.
Until a patch is available, consider the following mitigation strategies: 1. Implement strong input validation and sanitization for all user inputs, especially in the member_register.php file. 2. Use prepared statements or parameterized queries to prevent SQL injection. 3. Apply the principle of least privilege to the database user used by the application. 4. Consider temporarily disabling the affected functionality if possible without disrupting critical operations. 5. Monitor logs for any suspicious activities or unexpected SQL queries. 6. If feasible, place a Web Application Firewall (WAF) in front of the application to filter malicious inputs. 7. Regularly backup the database to ensure quick recovery in case of a successful attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2024-9986. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9986
A CVSS base score of 7.3 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.4%)
A CVSS base score of 9.8 has been assigned.