CVE-2024-10139: Pharmacy Management System SQLi Flaw

CVE-2024-10139 Overview

CVE-2024-10139 is a SQL injection vulnerability in code-projects Pharmacy Management System 1.0. The flaw resides in the /add_new_supplier.php script, where the name parameter is passed directly into a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires only low-level privileges. Public disclosure of the exploit technique increases the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers with low privileges can inject arbitrary SQL through the name parameter in /add_new_supplier.php, enabling unauthorized read, modification, or deletion of database records.

Affected Products

• code-projects Pharmacy Management System 1.0
• CPE: cpe:2.3:a:code-projects:pharmacy_management_system:1.0
• Vulnerable component: /add_new_supplier.php

Discovery Timeline

• 2024-10-19 - CVE-2024-10139 published to NVD
• 2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-10139

Vulnerability Analysis

The vulnerability exists in the supplier registration workflow of Pharmacy Management System 1.0. When a user submits data to /add_new_supplier.php, the application passes the name argument into a SQL statement without parameterization or input validation. An attacker can append SQL operators and subqueries to the name field, altering the structure of the executed query.

Because the endpoint is reachable over the network and requires only authenticated low-privilege access, exploitation is straightforward. Successful injection can expose supplier data, inventory records, user credentials, or any other tables accessible to the database account used by the application. The disclosed proof-of-concept lowers the barrier to weaponization.

Root Cause

The root cause is the direct concatenation of user-supplied input into a SQL query string. The application does not use prepared statements or parameter binding for the name field in /add_new_supplier.php. Input sanitization routines are either absent or insufficient to neutralize SQL metacharacters such as single quotes, comment sequences, and UNION operators.

Attack Vector

An attacker authenticates to the application with any low-privileged account and submits a crafted POST request to /add_new_supplier.php. The name parameter contains SQL injection payloads designed to break out of the original string literal. Typical exploitation patterns include boolean-based blind injection, UNION-based extraction, and stacked queries when the database driver permits them. See the GitHub Gist Snippet for the publicly disclosed proof-of-concept request.

No verified exploit code is reproduced here. The vulnerability mechanism follows the standard pattern for [CWE-89] injection: untrusted input is interpolated into a query, parsed by the database engine, and executed with the application's database privileges.

Detection Methods for CVE-2024-10139

Indicators of Compromise

• POST requests to /add_new_supplier.php containing SQL metacharacters such as ', --, UNION, SELECT, or OR 1=1 in the name parameter.
• Unexpected database errors logged by the PHP application or MySQL server referencing supplier insertion queries.
• Anomalous outbound data volume from the database server following requests to the supplier endpoint.
• New or modified rows in the suppliers table that do not correspond to legitimate user activity.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect form parameters submitted to /add_new_supplier.php for SQL injection signatures.
• Enable database query logging and alert on queries originating from the supplier endpoint that contain UNION, sleep, or information_schema references.
• Correlate web access logs with database audit logs to identify injection attempts followed by sensitive table reads.

Monitoring Recommendations

• Monitor authentication logs for low-privileged accounts generating unusual POST traffic to administrative endpoints.
• Alert on PHP error log entries referencing SQL syntax exceptions from add_new_supplier.php.
• Track HTTP 500 response spikes on supplier-related URIs, which often accompany injection probing.

How to Mitigate CVE-2024-10139

Immediate Actions Required

• Restrict network access to the Pharmacy Management System to trusted internal networks or VPN users until a patch is available.
• Disable or remove the add_new_supplier.php endpoint if the supplier registration feature is not required.
• Audit existing supplier and user tables for unauthorized modifications introduced after the publication date.
• Rotate database credentials used by the application and apply least-privilege principles to the database account.

Patch Information

No vendor patch has been published in the referenced advisories. Refer to the Code Projects Resource Hub for vendor updates, and consult VulDB ID #280927 for tracking remediation status. Until an official fix is released, organizations should apply compensating controls and consider replacing the affected component with a maintained alternative.

Workarounds

• Place a WAF in front of the application with SQL injection signatures enabled for the name parameter.
• Modify /add_new_supplier.php to use prepared statements with parameter binding via mysqli or PDO.
• Enforce strict server-side input validation that rejects SQL metacharacters in supplier name fields.
• Run the application's database account with read-only or table-scoped privileges where business logic permits.

# Example: Restrict access to the vulnerable endpoint at the web server level (nginx)
location = /add_new_supplier.php {
    allow 10.0.0.0/8;
    deny all;
}