Plataforma
php
Componente
job-portal
Corrigido em
1.0.1
A critical SQL injection vulnerability exists in Job Portal versions 1.0 through 1.0. This flaw allows an attacker to inject malicious SQL queries through the CATEGORY parameter within the /jobportal/admin/category/controller.php file, potentially leading to unauthorized data retrieval. The vulnerability has been resolved in version 1.0.1, and users are strongly advised to upgrade immediately.
The impact of this SQL injection vulnerability is severe. An attacker can leverage it to extract sensitive data stored within the Job Portal database. This could include user credentials, personal information, financial details, or any other data the application stores. Successful exploitation could lead to complete database compromise, allowing the attacker to modify or delete data, gain administrative access, or even execute arbitrary code on the server. The blast radius extends to all users of the Job Portal application and any systems connected to the database.
CVE-2024-8466 was publicly disclosed on September 5, 2024. As of this writing, there are no publicly available proof-of-concept exploits. The vulnerability's critical CVSS score suggests a high probability of exploitation if left unpatched. It is not currently listed on the CISA KEV catalog.
Organizations utilizing Job Portal for recruitment and applicant tracking are at significant risk. This includes businesses of all sizes, particularly those relying on the application for sensitive candidate data. Shared hosting environments where multiple applications share the same database are also at increased risk, as a compromise of one application could potentially expose data from others.
• php / server:
grep -r "SELECT.*FROM" /var/www/jobportal/• generic web:
curl -X POST -d "CATEGORY='; DROP TABLE users;--" http://your-jobportal-url/jobportal/admin/category/controller.php | grep "ERROR"disclosure
Status do Exploit
EPSS
0.12% (percentil 31%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2024-8466 is to upgrade to Job Portal version 1.0.1 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL queries targeting the CATEGORY parameter. Input validation and sanitization on the server-side can also help reduce the attack surface. Thoroughly review and update any existing database access controls to limit the potential damage from a successful attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload through the CATEGORY parameter and verifying that it is properly sanitized.
Actualizar a una versión parcheada del Job Portal proporcionada por PHPGurukul. Si no hay una versión parcheada disponible, revisar y sanear todas las entradas del parámetro CATEGORY en el archivo /jobportal/admin/category/controller.php para evitar la inyección SQL. Implementar validación y escape de datos antes de ejecutar consultas SQL.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2024-8466 is a critical SQL injection vulnerability affecting Job Portal versions 1.0–1.0. An attacker can exploit this flaw to retrieve data from the database using a crafted query.
If you are using Job Portal version 1.0, you are vulnerable. Upgrade to version 1.0.1 or later to resolve the issue.
The recommended fix is to upgrade to Job Portal version 1.0.1 or later. As a temporary workaround, implement a WAF rule to filter malicious SQL queries.
As of the current date, there are no confirmed reports of active exploitation, but the critical severity warrants immediate attention and patching.
Refer to the official Job Portal website or security announcements for the latest advisory regarding CVE-2024-8466.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.