CVE-2024-10138: Pharmacy Management System SQLi Flaw

CVE-2024-10138 Overview

CVE-2024-10138 is a SQL injection vulnerability in code-projects Pharmacy Management System 1.0. The flaw exists in the /add_new_purchase.php endpoint when invoked with the action=is_supplier parameter. Attackers can manipulate the name argument to inject arbitrary SQL into backend database queries. The exploit has been publicly disclosed and can be executed remotely over the network. Authentication at a low privilege level is required to reach the vulnerable code path. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers with low-privilege access can manipulate database queries through the name parameter, potentially exposing supplier records and other sensitive pharmacy data.

Affected Products

• code-projects Pharmacy Management System 1.0
• Component: /add_new_purchase.php (action is_supplier)
• Vulnerable parameter: name

Discovery Timeline

• 2024-10-19 - CVE-2024-10138 published to NVD
• 2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-10138

Vulnerability Analysis

The vulnerability resides in the supplier validation logic of add_new_purchase.php. When the script handles requests with action=is_supplier, it passes the name HTTP parameter directly into a SQL statement. The application performs no parameterization or input sanitization before query execution. An attacker can append SQL operators such as UNION SELECT, boolean conditions, or stacked queries to alter query semantics. The exploit is reachable over the network and does not require user interaction. Public disclosure on VulDB (entry #280926) and a GitHub Gist proof-of-concept increase the likelihood of opportunistic scanning against exposed instances.

Root Cause

The root cause is unsafe concatenation of untrusted input into a SQL query string. The name parameter flows from the HTTP request into the database driver without prepared statements, parameter binding, or context-aware escaping. PHP code following this pattern allows database control characters to break out of the intended string literal. This is a textbook [CWE-89] failure to neutralize special elements in SQL commands.

Attack Vector

An attacker sends a crafted HTTP request to /add_new_purchase.php?action=is_supplier with a malicious payload in the name parameter. Because the application returns data influenced by the manipulated query, both error-based and union-based extraction techniques are viable. Time-based blind injection also remains feasible if responses are uniform. The attack requires only network reachability to the web server and a low-privilege session.

No verified exploit code is available. See the GitHub Gist Snippet and VulDB #280926 for additional technical context.

Detection Methods for CVE-2024-10138

Indicators of Compromise

• HTTP requests to /add_new_purchase.php containing action=is_supplier with SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the name parameter.
• Unusual database error messages in web server or PHP logs referencing the add_new_purchase.php script.
• Outbound queries from the database host to attacker-controlled infrastructure following injection attempts.

Detection Strategies

• Deploy web application firewall rules that flag SQL injection patterns targeting the name parameter on the add_new_purchase.php endpoint.
• Enable verbose query logging on the MySQL backend and alert on syntactically anomalous queries originating from the pharmacy application user.
• Correlate authentication events with subsequent injection attempts to identify abuse of low-privilege accounts.

Monitoring Recommendations

• Monitor web server access logs for repeated 200 or 500 responses on /add_new_purchase.php with suspicious query strings.
• Track query execution time variance on the suppliers table to detect time-based blind SQL injection.
• Alert on database schema enumeration queries against information_schema from the application service account.

How to Mitigate CVE-2024-10138

Immediate Actions Required

• Restrict network exposure of the Pharmacy Management System to trusted internal segments or VPN-only access.
• Place the application behind a WAF and enable SQL injection signatures targeting the /add_new_purchase.php endpoint.
• Audit existing supplier and purchase records for unauthorized modifications.
• Rotate database credentials and reduce the application database user to least-privilege rights.

Patch Information

No official vendor patch has been published for CVE-2024-10138 in the referenced advisories. Operators should review the VulDB advisory and the code-projects website for updated builds. Where source is available, replace concatenated SQL in add_new_purchase.php with prepared statements using PDO or mysqli parameter binding.

Workarounds

• Apply input validation to reject non-alphanumeric characters in the name parameter before query execution.
• Implement parameterized queries or stored procedures for all database interactions in add_new_purchase.php.
• Disable or remove the vulnerable endpoint if the supplier check functionality is not required in production.

# Example: WAF/ModSecurity rule fragment to block SQLi on the affected endpoint
SecRule REQUEST_URI "@contains /add_new_purchase.php" \
  "chain,deny,status:403,id:1001138,msg:'CVE-2024-10138 SQLi attempt'"
  SecRule ARGS:name "@rx (?i)(union|select|sleep\(|or\s+1=1|--|;)" \
    "t:none,t:urlDecodeUni"