CVE-2024-10140: Pharmacy Management System SQLi Flaw

CVE-2024-10140 Overview

CVE-2024-10140 is a SQL injection vulnerability in code-projects Pharmacy Management System 1.0. The flaw resides in the /manage_supplier.php script, where the id parameter is passed directly into a SQL query without proper sanitization. An attacker can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires only low-privileged authentication. Public disclosure of the exploit increases the risk of opportunistic attacks against exposed deployments. The weakness is tracked as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote attackers with low privileges can inject SQL through the id parameter in /manage_supplier.php, potentially exposing or modifying database records in the Pharmacy Management System.

Affected Products

• code-projects Pharmacy Management System 1.0
• CPE: cpe:2.3:a:code-projects:pharmacy_management_system:1.0:*:*:*:*:*:*:*
• Component: code-projects:pharmacy_management_system

Discovery Timeline

• 2024-10-19 - CVE-2024-10140 published to NVD
• 2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-10140

Vulnerability Analysis

The vulnerability exists in the /manage_supplier.php endpoint of code-projects Pharmacy Management System 1.0. The application accepts user-supplied input through the id GET parameter and concatenates it directly into a backend SQL query. Because the input is not validated, sanitized, or parameterized, an attacker can break out of the intended query context. This allows the injection of additional SQL clauses such as UNION SELECT, boolean conditions, or stacked queries depending on the database engine. The endpoint requires a low-privileged authenticated session, but the attack can be launched remotely over the network without user interaction.

Root Cause

The root cause is improper neutralization of special elements in SQL queries [CWE-89]. The application constructs SQL statements through direct string concatenation of the id parameter rather than using prepared statements or parameterized queries. No input validation or output encoding layer is applied before the value reaches the database driver.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /manage_supplier.php with a malicious payload in the id query string parameter. The injected SQL is executed by the backend database, allowing the attacker to extract supplier data, enumerate other tables, modify records, or escalate impact depending on database privileges. The exploit has been publicly disclosed through a GitHub Gist Code Snippet and indexed by VulDB #280928.

No verified exploit code is reproduced here. Refer to the technical references for proof-of-concept details.

Detection Methods for CVE-2024-10140

Indicators of Compromise

• HTTP requests to /manage_supplier.php containing SQL metacharacters such as ', ", --, ;, or keywords like UNION, SELECT, SLEEP, or BENCHMARK within the id parameter.
• Unusual database errors or stack traces returned to clients accessing the supplier management endpoint.
• Spikes in query execution time on the backend database that correlate with requests to manage_supplier.php.
• Authenticated user sessions issuing high volumes of requests to a single endpoint with varying id values.

Detection Strategies

• Deploy a web application firewall (WAF) with signatures tuned for SQL injection patterns targeting the id parameter.
• Enable database query logging and alert on queries that contain comment sequences (--, #) or stacked statements originating from the application user.
• Correlate authenticated session activity with database error events in centralized logging to identify probing behavior.

Monitoring Recommendations

• Monitor web server access logs for anomalous query strings against /manage_supplier.php.
• Track database accounts used by the Pharmacy Management System for unexpected schema reads against information_schema or mysql.user.
• Alert on outbound data transfers from the database host that exceed baseline volumes.

How to Mitigate CVE-2024-10140

Immediate Actions Required

• Restrict network access to the Pharmacy Management System so that only trusted users can reach /manage_supplier.php.
• Place the application behind a WAF configured to block SQL injection payloads on the id parameter.
• Reduce the privileges of the database account used by the application to the minimum required for normal operation.
• Audit existing logs for prior exploitation attempts using the indicators listed above.

Patch Information

No official vendor patch has been published in the NVD references at the time of writing. Review the Code Projects Resource Hub and the VulDB CTI ID #280928 entry for any vendor updates. If an updated release becomes available, upgrade immediately. Until then, organizations should consider taking the application offline or isolating it from untrusted networks.

Workarounds

• Refactor /manage_supplier.php to use parameterized queries or prepared statements for any database interaction involving the id parameter.
• Add server-side input validation that enforces a strict numeric type for the id value before it reaches any SQL builder.
• Disable verbose database error reporting in production to limit information leakage during injection attempts.
• Implement network-level access controls so the application is not directly reachable from the public internet.

# Example: enforce numeric id validation at the web server layer (nginx)
location = /manage_supplier.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
}