CVE-2024-10409: Blood Bank Management System SQLi Flaw

CVE-2024-10409 Overview

CVE-2024-10409 is a SQL injection vulnerability in code-projects Blood Bank Management System 1.0. The flaw resides in the /file/accept.php endpoint, where the reqid parameter is passed to a backend SQL query without proper sanitization. An authenticated remote attacker can manipulate the reqid argument to inject arbitrary SQL statements. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Public exploit details have been disclosed, raising the likelihood of opportunistic use against exposed instances.

Critical Impact
Remote attackers with low-privilege access can read, modify, or delete database contents, including sensitive donor and blood inventory records.

Affected Products

Fabian Blood Bank Management System 1.0
code-projects Blood Bank Management 1.0
CPE: cpe:2.3:a:fabian:blood_bank_management_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-10-27 - CVE-2024-10409 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10409

Vulnerability Analysis

The vulnerability exists in the request-acceptance workflow implemented in /file/accept.php. The script receives a reqid parameter through an HTTP request and concatenates the value directly into a SQL statement. Because the parameter is neither validated nor bound as a prepared-statement variable, attacker-controlled SQL syntax reaches the database engine. Successful exploitation enables data disclosure, unauthorized record modification, and potential authentication bypass through UNION-based or boolean-based injection techniques.

The EPSS score of 0.545% (42.8 percentile) reflects a moderate probability of exploitation attempts within the next 30 days. No CISA KEV listing exists for this CVE at the time of writing.

Root Cause

The root cause is the direct interpolation of untrusted request input into a SQL query string. The accept.php script does not use parameterized queries or apply input filtering. This is a classic CWE-89 pattern common to PHP applications that build queries via string concatenation with values pulled from $_GET or $_POST superglobals.

Attack Vector

The attack is network-reachable and requires only low privileges on the target application. An attacker sends a crafted HTTP request to /file/accept.php with a malicious reqid value. Typical payloads include tautologies (1 OR 1=1), UNION SELECT statements to enumerate database schema, and time-based blind payloads such as 1 AND SLEEP(5) to confirm injection when responses lack visible errors. No user interaction is required. Refer to the VulDB entry #281939 and the public disclosure gist for additional technical context.

Detection Methods for CVE-2024-10409

Indicators of Compromise

HTTP requests to /file/accept.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the reqid parameter.
Web server access logs showing unusually long reqid values or repeated requests with incrementally modified parameter content.
Database error messages referencing MySQL syntax exceptions originating from accept.php requests.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the reqid query parameter.
Enable verbose query logging on the backend database and correlate slow or malformed queries with web request timestamps.
Configure endpoint and network detection tooling to alert on outbound data exfiltration patterns following anomalous requests to the application.

Monitoring Recommendations

Monitor authentication and session logs for low-privilege accounts issuing high volumes of requests to /file/accept.php.
Track database read volumes and unusual SELECT activity against donor and inventory tables.
Alert on any modification of application source files that could indicate secondary web shell installation after successful SQL injection.

How to Mitigate CVE-2024-10409

Immediate Actions Required

Restrict network access to the Blood Bank Management application to trusted internal networks or VPN users until a patch is applied.
Audit the accept.php handler and refactor the reqid parameter usage to use parameterized queries via PDO or mysqli prepared statements.
Review database and application logs for signs of prior exploitation, focusing on requests to /file/accept.php.

Patch Information

No vendor patch has been published for Blood Bank Management System 1.0 at the time of writing. Organizations running this application should treat it as unpatched and consider decommissioning or replacing it with a maintained alternative. Refer to the code-projects site for any updates.

Workarounds

Place the application behind a WAF configured with OWASP Core Rule Set SQL injection rules and enforce strict input validation on the reqid parameter.
Apply least-privilege principles to the database account used by the application, removing write and administrative privileges where not required.
If source-level changes are feasible, replace the vulnerable query construction with prepared statements and cast reqid to an integer before use.

bash

# Example nginx location block to restrict and log access to the vulnerable endpoint
location = /file/accept.php {
    allow 10.0.0.0/8;
    deny all;
    access_log /var/log/nginx/accept_php.log;
}