CVE-2024-0543: Codeastro Real Estate System SQLi Flaw

CVE-2024-0543 Overview

CVE-2024-0543 is a SQL injection vulnerability in CodeAstro Real Estate Management System through version 1.0. The flaw resides in the propertydetail.php file, where the pid parameter is passed directly to a database query without proper sanitization. Remote attackers can manipulate the pid argument to inject arbitrary SQL statements. The vulnerability requires no authentication and no user interaction. A public exploit has been disclosed under VulDB identifier VDB-250713, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents, including user credentials and property records, through SQL injection in propertydetail.php.

Affected Products

• CodeAstro Real Estate Management System versions up to and including 1.0
• Deployments exposing propertydetail.php to the internet
• Web applications built on the unpatched CodeAstro codebase

Discovery Timeline

• 2024-01-15 - CVE-2024-0543 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0543

Vulnerability Analysis

The vulnerability exists in the propertydetail.php script of the CodeAstro Real Estate Management System. The pid parameter, supplied via HTTP request, is concatenated into a SQL query without parameterization or input validation. Attackers can append SQL syntax to the parameter value, altering the structure of the executed query. This enables data exfiltration through UNION-based, error-based, or boolean-based injection techniques. The vulnerability is exploitable remotely over the network and requires no privileges or user interaction. Confidentiality of the backend database is the primary impact, as reflected in the CVSS confidentiality-only profile.

Root Cause

The root cause is the absence of prepared statements or parameterized queries when handling the pid URL parameter in propertydetail.php. User-controlled input is interpolated directly into the SQL query string. The application also lacks input type validation, allowing non-numeric SQL payloads where an integer property identifier is expected. This pattern represents a textbook [CWE-89] flaw.

Attack Vector

An attacker crafts an HTTP request targeting propertydetail.php with a malicious pid value. For example, payloads using UNION SELECT clauses can return arbitrary database columns in the application response. Boolean-based blind payloads can be used when responses do not directly reflect query output. Because the endpoint is public and unauthenticated, the attack is trivially scriptable. The disclosed public proof-of-concept lowers the technical barrier for exploitation.

No verified exploit code is reproduced here. Refer to the VulDB entry #250713 for technical details on the disclosed payload.

Detection Methods for CVE-2024-0543

Indicators of Compromise

• HTTP requests to propertydetail.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the pid parameter
• Unusually long or URL-encoded pid parameter values containing single quotes, comments (--, #), or boolean operators
• Database error messages returned in HTTP responses from the application
• Anomalous outbound database query volume originating from the web application user

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL metacharacters in the pid query string parameter
• Enable database query logging and alert on queries containing tautologies or schema enumeration patterns
• Correlate web server access logs with database audit logs to identify injection attempts and downstream data access

Monitoring Recommendations

• Monitor for repeated 500-series HTTP responses from propertydetail.php, which may indicate injection probing
• Track requests from single source IPs sending many variations of the pid parameter within short time windows
• Alert on database accounts used by the application executing queries against mysql.user or information_schema tables

How to Mitigate CVE-2024-0543

Immediate Actions Required

• Restrict public access to propertydetail.php until a vendor patch or code fix is applied
• Place the application behind a WAF configured to block SQL injection patterns on the pid parameter
• Audit web server and database logs for evidence of prior exploitation attempts
• Rotate database credentials and review user data for unauthorized access

Patch Information

At the time of publication, no official vendor advisory or patch is referenced in the NVD entry for CVE-2024-0543. Operators should monitor the VulDB advisory and the CodeAstro vendor channels for fix availability. Until a vendor patch is released, apply the code-level workarounds below.

Workarounds

• Modify propertydetail.php to use parameterized queries or PDO prepared statements when handling the pid parameter
• Cast pid to an integer using intval() before incorporating it into any SQL statement
• Apply least-privilege principles to the database account used by the application, removing access to non-essential tables
• Disable verbose database error messages in the production PHP configuration to limit information leakage

# Example: enforce integer validation on the pid parameter in PHP
# Replace direct concatenation with parameterized query
$pid = filter_input(INPUT_GET, 'pid', FILTER_VALIDATE_INT);
if ($pid === false) {
    http_response_code(400);
    exit('Invalid property identifier');
}
$stmt = $pdo->prepare('SELECT * FROM properties WHERE id = :pid');
$stmt->execute([':pid' => $pid]);