CVE-2024-10024: Pharmacy Management System SQLi Flaw

CVE-2024-10024 Overview

CVE-2024-10024 is a SQL injection vulnerability in code-projects Pharmacy Management System 1.0. The flaw resides in the /php/manage_medicine_stock.php script, where the name, packing, generic_name, and suppliers_name parameters are passed to database queries without proper sanitization. An authenticated remote attacker can manipulate these parameters to inject arbitrary SQL statements. The exploit technique has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers with low-privilege access can inject SQL statements through the medicine stock management interface, potentially compromising the integrity and confidentiality of the pharmacy database.

Affected Products

code-projects Pharmacy Management System 1.0
CPE: cpe:2.3:a:code-projects:pharmacy_management_system:1.0
Vulnerable component: /php/manage_medicine_stock.php

Discovery Timeline

2024-10-16 - CVE-2024-10024 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10024

Vulnerability Analysis

The vulnerability affects the medicine stock management functionality of the Pharmacy Management System. The manage_medicine_stock.php script accepts user-supplied parameters and concatenates them directly into SQL queries. Attackers can supply crafted input to the name, packing, generic_name, or suppliers_name arguments to break out of the intended query context. Successful exploitation allows extraction of database records, modification of stock data, or authentication bypass through UNION-based and boolean-based injection techniques. The EPSS score of 0.613% reflects moderate probability of exploitation activity within the next 30 days.

Root Cause

The root cause is the lack of parameterized queries or input sanitization in the affected PHP endpoint. User input from HTTP request parameters is interpolated into raw SQL strings before execution. This pattern is characteristic of CWE-89 weaknesses in PHP applications that fail to use prepared statements via PDO or mysqli with bound parameters.

Attack Vector

Exploitation requires network access to the web application and low-privilege authenticated credentials. An attacker sends a crafted HTTP request to /php/manage_medicine_stock.php with malicious payloads in the vulnerable parameters. No user interaction is required. Because the exploit has been disclosed publicly through the GitHub Gist Code Snippet and VulDB #280559, attackers can trivially adapt available payloads against exposed instances.

No verified exploit code is republished here. Refer to the VulDB advisory for technical details on the injection payload structure.

Detection Methods for CVE-2024-10024

Indicators of Compromise

HTTP POST or GET requests to /php/manage_medicine_stock.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #) in the name, packing, generic_name, or suppliers_name parameters.
Unexpected database errors in web server or PHP error logs referencing the medicine stock management script.
Anomalous outbound data volumes from the database server following requests to the affected endpoint.

Detection Strategies

Deploy web application firewall rules to identify SQL injection patterns targeting the affected PHP endpoint.
Enable MySQL general query logging and correlate suspicious queries with source IP addresses accessing manage_medicine_stock.php.
Review authentication logs for low-privilege accounts making unusual volumes of requests to stock management functions.

Monitoring Recommendations

Alert on repeated HTTP 500 responses from /php/manage_medicine_stock.php, which often indicate injection probing.
Baseline normal parameter values for pharmacy stock operations and flag deviations containing SQL syntax.
Monitor database user activity for unexpected INFORMATION_SCHEMA queries originating from the web application service account.

How to Mitigate CVE-2024-10024

Immediate Actions Required

Restrict network access to the Pharmacy Management System web interface to trusted networks or VPN only.
Disable or remove the manage_medicine_stock.php endpoint if it is not required for operations.
Rotate credentials for the database service account used by the application and audit its assigned privileges.
Review web server access logs for prior exploitation attempts referencing the vulnerable parameters.

Patch Information

No official vendor patch is listed for code-projects Pharmacy Management System 1.0 in the referenced advisories. Consult the Code Projects Resource Hub for updated releases. Until an official fix is available, apply the workarounds below and consider migrating to a maintained pharmacy management solution.

Workarounds

Modify the affected PHP code to use parameterized queries with PDO prepared statements or mysqli bind parameters instead of string concatenation.
Apply server-side input validation that rejects non-alphanumeric characters in the name, packing, generic_name, and suppliers_name fields where possible.
Deploy a web application firewall with SQL injection signatures in front of the application to block known payload patterns.
Enforce least-privilege database permissions so the application account cannot access sensitive tables or execute administrative statements.

bash

# Example ModSecurity rule to block SQL injection attempts against the affected endpoint
SecRule REQUEST_URI "@contains /php/manage_medicine_stock.php" \
    "id:1000024,phase:2,deny,status:403,log,\
    msg:'CVE-2024-10024 SQLi attempt',\
    chain"
    SecRule ARGS:name|ARGS:packing|ARGS:generic_name|ARGS:suppliers_name \
        "@detectSQLi" \
        "t:none,t:urlDecode,t:lowercase"