CVE-2024-0502: House Rental Management System SQLi Flaw

CVE-2024-0502 Overview

CVE-2024-0502 is a SQL injection vulnerability in SourceCodester House Rental Management System 1.0. The flaw resides in the manage_user.php file within the Edit User component. Attackers can manipulate the id, name, or username parameters to inject arbitrary SQL statements against the backend database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Remote exploitation is possible, and the exploit details have been disclosed publicly through VulDB entry 250610.

Critical Impact
Authenticated attackers can remotely execute arbitrary SQL commands, resulting in database compromise, credential theft, and full application takeover.

Affected Products

Oretnom23 House Rental Management System 1.0
SourceCodester House Rental Management System (distribution channel)
manage_user.php Edit User component

Discovery Timeline

2024-01-13 - CVE-2024-0502 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0502

Vulnerability Analysis

The vulnerability resides in manage_user.php, part of the Edit User workflow of the House Rental Management System. The application accepts the id, name, and username parameters from user-supplied input and concatenates them directly into SQL queries. Because the parameters are not sanitized or parameterized, an attacker can break out of the intended query context and inject arbitrary SQL clauses.

Successful exploitation grants read and write access to the underlying database. Attackers can extract user credentials, modify tenant records, or escalate privileges within the application. The attack requires network access and high privileges to reach the Edit User functionality, but it does not require user interaction.

Root Cause

The root cause is improper neutralization of special elements in SQL commands, tracked as [CWE-89]. The developer relied on direct string concatenation to build SQL statements from HTTP request parameters. No prepared statements or input validation routines guard the affected parameters in manage_user.php.

Attack Vector

An authenticated attacker sends a crafted HTTP request to manage_user.php containing malicious SQL payloads in the id, name, or username fields. The injected payload is evaluated by the backend database engine. Public disclosure of the exploit in VulDB entry 250610 lowers the barrier to weaponization. See the VulDB advisory for additional technical detail.

Detection Methods for CVE-2024-0502

Indicators of Compromise

Web server access logs containing SQL metacharacters (', --, UNION, SELECT) in requests to manage_user.php.
Anomalous POST or GET requests to the Edit User endpoint with unusual id, name, or username values.
Unexpected database errors or verbose SQL exceptions returned to clients.

Detection Strategies

Deploy web application firewall rules that identify SQL injection signatures on requests targeting manage_user.php.
Enable database query logging and alert on syntactically anomalous queries originating from the application user.
Correlate authentication events with subsequent Edit User requests to identify suspicious administrative sessions.

Monitoring Recommendations

Monitor outbound connections from the database host for signs of data exfiltration.
Track failed login attempts followed by successful sessions accessing the Edit User component.
Review PHP error logs for stack traces referencing manage_user.php and database driver exceptions.

How to Mitigate CVE-2024-0502

Immediate Actions Required

Restrict network access to the House Rental Management System until a patch is applied, exposing it only to trusted administrators.
Rotate credentials for all application users and the database service account.
Audit manage_user.php request logs for prior exploitation attempts.

Patch Information

No vendor patch has been published for CVE-2024-0502 at the time of writing. Organizations running SourceCodester House Rental Management System 1.0 should treat the software as unmaintained and evaluate migration to a supported alternative. Reference VulDB CTI #250610 for further vendor status updates.

Workarounds

Place the application behind a web application firewall configured with SQL injection rule sets.
Modify manage_user.php to use prepared statements with parameterized queries via PDO or MySQLi.
Enforce strict input validation on the id, name, and username parameters, allowing only expected character sets and lengths.
Limit database account privileges to the minimum required, denying schema modification rights to the application user.

bash

# Example: WAF rule (ModSecurity) to block SQLi on manage_user.php
SecRule REQUEST_URI "@contains /manage_user.php" \
    "phase:2,deny,status:403,id:1002024,\
     chain,msg:'CVE-2024-0502 SQLi attempt'"
    SecRule ARGS:id|ARGS:name|ARGS:username \
        "@detectSQLi" "t:none,t:urlDecodeUni"