CVE-2024-10415 Overview
CVE-2024-10415 is a SQL injection vulnerability in code-projects Blood Bank Management System 1.0. The flaw affects the /file/accept.php endpoint, where the reqid parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated remote attackers can inject SQL through the reqid parameter in /file/accept.php, exposing donor and blood bank records to unauthorized read, modification, or deletion.
Affected Products
- Fabian Blood Bank Management System 1.0
- code-projects Blood Bank Management System distribution
- Deployments exposing /file/accept.php to untrusted networks
Discovery Timeline
- 2024-10-27 - CVE-2024-10415 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10415
Vulnerability Analysis
The vulnerability resides in /file/accept.php, a server-side PHP handler within Blood Bank Management System 1.0. The script consumes the reqid request parameter and concatenates it directly into a SQL statement executed against the backing database. Because no parameterization or input validation is performed, an attacker controls part of the resulting query.
A successful attack allows extraction of arbitrary data from the database, including donor identity information and administrative credentials stored in the application schema. Depending on database privileges, an attacker can also modify or delete records related to blood requests and inventory. Public disclosure of the exploit details on GitHub Gist and VulDB lowers the barrier to entry for opportunistic actors. The EPSS estimate for near-term exploitation stands at 0.592%.
Root Cause
The root cause is missing input neutralization on the reqid parameter before it enters a SQL query. The handler trusts client-supplied data and constructs the query through string concatenation. This pattern is characteristic of [CWE-89] and typically arises when developers omit prepared statements or parameterized queries in favor of dynamic SQL.
Attack Vector
Exploitation is remote and requires network reach to the application. An attacker sends a crafted HTTP request to /file/accept.php with a malicious payload in the reqid parameter. The attack complexity is low, and no user interaction is required. Some privilege level is expected to reach the endpoint, though many deployments front accept.php with weak or default authentication.
A representative proof of concept is published in the referenced GitHub Gist PoC Example, which demonstrates how a UNION-based payload injected through reqid returns database records in the HTTP response.
Detection Methods for CVE-2024-10415
Indicators of Compromise
- HTTP requests to /file/accept.php with SQL metacharacters in the reqid parameter such as ', --, UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA.
- Web server access logs showing repeated reqid values with unusual length or encoded payloads (%27, %20UNION%20).
- Database error messages or 500 responses correlated with accept.php requests, indicating malformed injected SQL.
- Unexpected outbound data volumes from the web server hosting Blood Bank Management System.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect the reqid parameter for SQL injection signatures and block or alert on matches.
- Enable database query logging and alert on queries originating from accept.php that reference information_schema or use stacked statements.
- Correlate HTTP request logs with database audit logs to identify parameter tampering patterns.
Monitoring Recommendations
- Monitor authentication events for the Blood Bank Management System and flag session activity that immediately targets /file/accept.php with anomalous parameters.
- Track error rates on the application; sudden spikes in database errors often accompany SQL injection probing.
- Baseline normal reqid values (numeric identifiers) and alert on deviations such as strings, quotes, or SQL keywords.
How to Mitigate CVE-2024-10415
Immediate Actions Required
- Restrict network access to Blood Bank Management System 1.0 so that /file/accept.php is not reachable from untrusted networks.
- Place the application behind a WAF configured with SQL injection rulesets and enable blocking mode for the reqid parameter.
- Rotate database credentials used by the application and reduce the database user's privileges to the minimum required.
- Review web server and database logs for prior exploitation attempts referencing accept.php.
Patch Information
No vendor advisory or official patch has been published for Blood Bank Management System 1.0 at the time of writing. Operators should treat the software as unmaintained and plan migration to a supported alternative. Consult the Code Projects Resource Hub and VulDB #281956 for any future updates.
Workarounds
- Modify /file/accept.php to use prepared statements with parameter binding (PDO::prepare with bound parameters or mysqli_stmt_bind_param) instead of string concatenation.
- Enforce strict server-side type validation on reqid, rejecting any value that is not a positive integer.
- Apply least-privilege database roles so the application account cannot read from information_schema or write outside its required tables.
- If code changes are not possible, isolate the application inside a segmented VLAN accessible only over a VPN with strong authentication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
