CVE-2024-10742: Wazifa System SQL Injection Vulnerability

CVE-2024-10742 Overview

CVE-2024-10742 is a SQL injection vulnerability in code-projects Wazifa System 1.0. The flaw exists in the /controllers/control.php file, where unsanitized user-supplied input is passed directly into a database query. A remote attacker with low privileges can manipulate the vulnerable parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote attackers can inject arbitrary SQL statements through /controllers/control.php, potentially exposing or modifying data stored in the Wazifa System database.

Affected Products

code-projects Wazifa System 1.0
Anisha Wazifa System (CPE: cpe:2.3:a:anisha:wazifa_system:1.0:*:*:*:*:*:*:*)
All deployments running the vulnerable /controllers/control.php endpoint

Discovery Timeline

2024-11-03 - CVE-2024-10742 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10742

Vulnerability Analysis

The vulnerability resides in the /controllers/control.php script of the Wazifa System web application. The script accepts user-controlled input and concatenates it into an SQL query without proper sanitization or parameterization. This allows an authenticated remote attacker to alter the intended query structure and execute arbitrary SQL commands against the backend database.

Because the attack vector is network-based and requires only low privileges with no user interaction, exploitation can be automated once an attacker identifies an exposed instance. Public disclosure of the exploit further lowers the barrier to attack.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The application constructs SQL queries by concatenating request parameters directly into query strings. Without prepared statements or input validation, meta-characters such as single quotes and SQL keywords are interpreted as query syntax rather than data values.

Attack Vector

An attacker sends a crafted HTTP request to the /controllers/control.php endpoint with a malicious payload in the vulnerable parameter. The injected SQL is executed by the database engine, enabling data extraction, authentication bypass, or record modification depending on the privileges of the database user. Full technical details of the injection are documented in the GitHub SQL Vulnerability Details writeup.

No verified proof-of-concept code is republished here. Refer to the public disclosure referenced above for the exact request structure and payload details.

Detection Methods for CVE-2024-10742

Indicators of Compromise

HTTP requests to /controllers/control.php containing SQL meta-characters such as ', --, UNION SELECT, or OR 1=1
Unusual database error messages returned to clients originating from control.php
Unexpected read or write activity in Wazifa System database tables from the web application service account

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and POST bodies destined for /controllers/control.php for SQL injection signatures
Enable verbose query logging on the backend database and alert on queries containing tautologies, UNION operators, or comment sequences
Correlate web server access logs with database audit logs to identify anomalous query patterns tied to a single source IP

Monitoring Recommendations

Monitor authentication logs for unusual login patterns that could indicate credential harvesting via SQL injection
Track outbound data volume from the database server for signs of bulk data extraction
Alert on any modification of privileged user records or administrative tables within the Wazifa System schema

How to Mitigate CVE-2024-10742

Immediate Actions Required

Restrict network access to Wazifa System 1.0 instances until a vendor patch is available
Place the application behind a WAF configured with SQL injection protection rulesets
Review database and application logs for evidence of prior exploitation attempts against /controllers/control.php
Enforce least-privilege permissions on the database account used by the application

Patch Information

At the time of publication, no official vendor patch has been published for CVE-2024-10742. Consult the Code Projects Security Resources and VulDB entry #282911 for updates on remediation availability. Organizations should evaluate whether continued use of Wazifa System 1.0 is appropriate given the disclosed vulnerability and absence of a fix.

Workarounds

Refactor /controllers/control.php to use parameterized queries or prepared statements for all database interactions
Apply strict server-side input validation and allowlist-based filtering on all user-supplied parameters
Disable public internet exposure of the application and restrict access to trusted internal networks or via VPN
Rotate database credentials and audit stored data if any indicators of compromise are identified

bash

# Example WAF rule concept for detecting SQL injection attempts against control.php
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /controllers/control.php" \
    "phase:2,chain,deny,status:403,id:1004210742,\
    msg:'Potential SQLi against Wazifa System control.php (CVE-2024-10742)'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*?\*/)+select|or\s+1=1|--|;drop\s+table)" \
        "t:none,t:urlDecodeUni"