CVE-2024-10741: E-Health Care System SQLi Vulnerability

CVE-2024-10741 Overview

CVE-2024-10741 is a SQL injection vulnerability in code-projects E-Health Care System 1.0, developed by Anisha. The flaw resides in the /Users/registration.php script, where the f_name parameter is passed into a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse. Additional parameters in the same endpoint may also be vulnerable.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the application database, potentially exposing patient data, modifying records, or compromising the underlying data store.

Affected Products

code-projects / Anisha E-Health Care System 1.0
The vulnerable endpoint /Users/registration.php
Deployments exposing the f_name registration parameter to untrusted input

Discovery Timeline

2024-11-03 - CVE-2024-10741 published to NVD
2024-11-05 - Last updated in NVD database

Technical Details for CVE-2024-10741

Vulnerability Analysis

The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The registration.php script accepts user-supplied input through the f_name parameter during account registration. The application concatenates this input directly into a SQL statement instead of using parameterized queries or prepared statements.

An attacker can submit crafted SQL syntax in the f_name field to alter the structure of the query. This grants the attacker the ability to read arbitrary tables, modify data, or perform authentication bypass depending on the surrounding query context. Because the endpoint is reachable pre-authentication, exploitation does not require valid credentials.

Root Cause

The root cause is missing input validation and the use of dynamic SQL string concatenation in registration.php. User-controlled input from the registration form is interpolated into a SQL query without escaping or parameter binding. PHP applications using the MySQLi or PDO APIs prevent this class of flaw through prepared statements, but this codebase does not apply that pattern to the f_name field.

Attack Vector

Exploitation occurs over the network through a standard HTTP POST request to /Users/registration.php. The attacker submits a malicious payload in the f_name field, such as boolean-based or UNION-based SQL injection strings. No authentication and no user interaction are required. The disclosed proof of concept on the public GitHub reference demonstrates the injection pattern. See the GitHub CVE SQL Injection Info and VulDB #282910 entries for technical details.

Detection Methods for CVE-2024-10741

Indicators of Compromise

HTTP POST requests to /Users/registration.php containing SQL metacharacters such as ', --, UNION SELECT, OR 1=1, or SLEEP( in the f_name parameter
Web server access logs showing unusually long or encoded f_name values from a single source IP
Database error messages referencing syntax errors triggered by registration submissions
Spikes in registration traffic from anonymizing proxies or known scanning infrastructure

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to /Users/registration.php for SQL injection signatures
Enable database query logging and alert on queries originating from the registration handler that contain tautologies or stacked statements
Correlate failed registration attempts with subsequent successful authentications from the same source

Monitoring Recommendations

Forward web server, application, and MySQL logs to a centralized analytics platform for cross-source correlation
Baseline normal registration parameter lengths and content, then alert on deviations
Monitor outbound traffic from the database host for unexpected data egress that could indicate exfiltration

How to Mitigate CVE-2024-10741

Immediate Actions Required

Restrict network access to the E-Health Care System until a fix is applied, particularly the /Users/registration.php endpoint
Place a WAF in front of the application and enable SQL injection protection rulesets in blocking mode
Audit database accounts used by the web application and remove unnecessary privileges such as FILE, DROP, and administrative rights
Review database and application logs for prior exploitation attempts referencing the f_name parameter

Patch Information

No official vendor advisory or patch is listed in the NVD entry for CVE-2024-10741. Organizations running code-projects E-Health Care System 1.0 should monitor the Code Projects site and the VulDB CTI Incident #282910 record for updates. Where no upstream fix exists, apply source-level remediation by replacing dynamic SQL with prepared statements using PDO or MySQLi parameter binding for all input fields in registration.php.

Workarounds

Modify registration.php to validate f_name against a strict allowlist such as [A-Za-z\- ]{1,50} before any database operation
Refactor the query handling code to use prepared statements with bound parameters for every user-supplied value
Run the application database user with read/write access scoped only to required tables, denying schema modification rights
Disable verbose database error reporting in production to reduce information leakage that aids injection tuning

bash

# Example PHP remediation using PDO prepared statements
$stmt = $pdo->prepare(
    "INSERT INTO users (f_name, l_name, email) VALUES (:f_name, :l_name, :email)"
);
$stmt->execute([
    ':f_name' => $_POST['f_name'],
    ':l_name' => $_POST['l_name'],
    ':email'  => $_POST['email'],
]);