CVE-2024-0459: Blood Bank Management System SQL Injection

CVE-2024-0459 Overview

CVE-2024-0459 is a SQL injection vulnerability in Phpgurukul Blood Bank & Donor Management System 5.6. The flaw resides in the /admin/request-received-bydonar.php script, where unsanitized input is passed directly into a SQL query [CWE-89]. An authenticated remote attacker can manipulate query parameters to inject arbitrary SQL statements against the backend database. The exploit has been publicly disclosed under identifier VDB-250564, increasing the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Successful exploitation allows attackers to read, modify, or delete sensitive donor and blood inventory records, and can lead to full database compromise.

Affected Products

Phpgurukul Blood Bank & Donor Management System 5.6
Administrative component: /admin/request-received-bydonar.php
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2024-01-12 - CVE-2024-0459 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-0459

Vulnerability Analysis

The vulnerability is a classic SQL injection defect in the admin-facing request handler /admin/request-received-bydonar.php. The script accepts a request parameter and concatenates it into a SQL statement without parameterization or input validation. Because the query executes with the application's database privileges, injected SQL runs with the same level of access as the legitimate application logic.

An attacker with valid administrator credentials can craft HTTP requests that alter the query structure. Typical exploitation involves UNION-based payloads to exfiltrate rows from other tables, boolean-based payloads to enumerate data character by character, or time-based payloads to confirm blind injection. The database backend used by the application returns results directly to the attacker in many cases, enabling immediate data exfiltration.

The scope of impact covers confidentiality, integrity, and availability. Attackers can read donor personal information, modify blood request records, or drop tables to disrupt operations.

Root Cause

The root cause is the absence of prepared statements or input sanitization when handling user-supplied parameters in request-received-bydonar.php. The application inserts untrusted input directly into a dynamically constructed SQL query, violating secure coding practice for database interaction [CWE-89].

Attack Vector

Exploitation occurs remotely over HTTP against the admin panel. The attacker must hold high-privilege credentials, as the endpoint is located under /admin/. No user interaction is required beyond issuing the crafted request. Once authenticated, the attacker submits malicious values through the vulnerable parameter, and the application executes the injected SQL against the database.

The vulnerability manifests in a single PHP handler. Refer to the VulDB entry for #250564 and the public disclosure document for parameter-level details.

Detection Methods for CVE-2024-0459

Indicators of Compromise

HTTP requests to /admin/request-received-bydonar.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP(
Database error messages returned in HTTP responses from the admin path
Unexpected administrative session activity from unfamiliar source IP addresses
Sudden spikes in query duration or database CPU coinciding with admin panel traffic

Detection Strategies

Deploy web application firewall rules that flag SQL injection signatures targeting the /admin/ path of the Blood Bank application
Enable database query logging and alert on statements originating from the affected PHP script that contain UNION SELECT, INFORMATION_SCHEMA, or stacked queries
Correlate authentication logs with anomalous admin-panel request volumes to detect credential abuse preceding injection attempts

Monitoring Recommendations

Monitor web server access logs for repeated 500-series responses on request-received-bydonar.php
Track outbound data volume from the database host to detect bulk extraction
Alert on the creation, modification, or deletion of database users and tables during business hours

How to Mitigate CVE-2024-0459

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlists or VPN-only reachability until a fix is applied
Rotate all administrator credentials for the Blood Bank & Donor Management System
Review database audit logs for evidence of prior injection attempts and unauthorized data access
Back up the database and verify integrity of donor and request records

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD entry for CVE-2024-0459. Consult the VulDB advisory and the Phpgurukul project page for updates. Organizations that require the application should apply the workarounds below and monitor for a maintainer release.

Workarounds

Replace direct query concatenation in request-received-bydonar.php with parameterized queries using PDO prepared statements
Apply strict server-side input validation on all parameters accepted by admin scripts, rejecting non-alphanumeric characters where not required
Configure the database account used by the application with least-privilege rights, removing DROP, ALTER, and cross-database SELECT permissions
Deploy a web application firewall in blocking mode with an OWASP CRS ruleset covering SQL injection

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the vulnerable path
SecRule REQUEST_URI "@contains /admin/request-received-bydonar.php" \
    "phase:2,chain,deny,status:403,id:1002459,msg:'CVE-2024-0459 SQLi attempt'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|--\s|;\s*drop)"