SQL injection vulnerability in Sentrifugo

The SQL injection vulnerability in Sentrifugo 3.2 poses a significant risk to data confidentiality. An attacker can exploit this flaw to craft malicious SQL queries that, when executed by the application, could extract sensitive data stored in the database. This could include user credentials, financial information, or other confidential business data. Successful exploitation could lead to complete database compromise, allowing the attacker to view, modify, or delete data. The potential for lateral movement is limited to the database server itself, but the blast radius is substantial due to the potential for widespread data exposure.

Organizations utilizing Sentrifugo 3.2 for reporting and analytics are at significant risk. This includes those with sensitive data stored within the Sentrifugo database, such as user information or financial records. Shared hosting environments where multiple users share the same Sentrifugo instance are particularly vulnerable, as a compromise of one user's account could potentially lead to data exposure for all users on the server.

• php: Examine web server access logs for requests to /sentrifugo/index.php/default/reports/activeuserrptpdf containing unusual characters or SQL keywords in the sort_name parameter.

grep 'sort_name=.*;(SELECT|UNION|INSERT|DELETE|UPDATE|DROP)' /var/log/apache2/access.log

• php: Monitor PHP error logs for SQL syntax errors related to the sort_name parameter. • generic web: Use curl to test the endpoint with various SQL injection payloads and observe the response.

curl 'http://your-sentrifugo-server/sentrifugo/index.php/default/reports/activeuserrptpdf?sort_name=1%20OR%201=1' 

1. 2024-03-21Disclosure

   disclosure

2. 2024-03-21Patch

   patch

1. आरक्षित2024-03-21
2. प्रकाशित2024-03-21
3. संशोधित2024-08-12
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-29874 is to immediately upgrade Sentrifugo to version 3.2.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL queries targeting the /sentrifugo/index.php/default/reports/activeuserrptpdf endpoint. Specifically, block requests containing suspicious characters or SQL keywords in the 'sortname' parameter. Input validation on the server-side, specifically sanitizing the 'sortname' parameter, can also provide a temporary layer of defense. After upgrading, confirm the vulnerability is resolved by attempting a test SQL injection query through the affected endpoint and verifying that it is properly sanitized.