CVE-2024-10759 Overview
CVE-2024-10759 is a SQL injection vulnerability in itsourcecode Farm Management System 1.0. The flaw resides in the /edit-pig.php file, where user-supplied input passed through the pigno, weight, arrived, breed, remark, and status parameters is concatenated directly into SQL statements. Authenticated remote attackers can manipulate these parameters to alter database queries. The exploit details have been disclosed publicly, increasing the risk of opportunistic attacks against exposed installations. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Remote attackers with low privileges can inject arbitrary SQL through /edit-pig.php, exposing farm operations data and potentially enabling database manipulation.
Affected Products
- Angeljudesuarez Farm Management System 1.0
- Component: /edit-pig.php
- Vulnerable parameters: pigno, weight, arrived, breed, remark, status
Discovery Timeline
- 2024-11-04 - CVE-2024-10759 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10759
Vulnerability Analysis
The vulnerability is a classic SQL injection issue in a PHP-based web application. The /edit-pig.php script accepts multiple HTTP parameters that update pig records in the underlying database. These parameters flow into SQL statements without parameterization or proper sanitization. An attacker can submit crafted values that break out of the intended query context and append attacker-controlled SQL clauses.
The original researcher advisory identifies pigno as vulnerable, but multiple sibling parameters share the same code path. Treat weight, arrived, breed, remark, and status as equally exploitable until proven otherwise. Successful exploitation can disclose database contents, modify farm records, or pivot to further application abuse depending on database privileges.
Root Cause
The root cause is direct concatenation of untrusted input into SQL queries within /edit-pig.php. The application does not use prepared statements, parameterized queries, or input validation. This maps to CWE-89, which covers improper neutralization of SQL syntax elements in dynamically constructed queries.
Attack Vector
The attack is remote and network-reachable over the application's HTTP interface. An authenticated user with low privileges submits crafted parameter values to /edit-pig.php. Because the exploit has been publicly disclosed, adversaries can reproduce the technique using standard tooling such as SQL injection scanners. No user interaction beyond the attacker's own request is required.
Refer to the GitHub CVE Issue Discussion and VulDB entry #282928 for the published exploitation details.
Detection Methods for CVE-2024-10759
Indicators of Compromise
- HTTP requests to /edit-pig.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or comment sequences (--, #).
- Unusually long or encoded values submitted in pigno, weight, arrived, breed, remark, or status parameters.
- Database error messages returned to clients or written to application logs referencing MySQL syntax failures.
- Outbound database connections or query patterns that deviate from normal farm record update workflows.
Detection Strategies
- Deploy web application firewall (WAF) signatures that inspect POST and GET parameters to /edit-pig.php for SQL injection payloads.
- Enable database query logging and alert on queries against the pig records table that contain boolean-based or time-based injection patterns.
- Correlate authentication events with subsequent access to /edit-pig.php to identify low-privilege accounts probing the endpoint.
Monitoring Recommendations
- Forward web server access logs and database audit logs to a centralized analytics platform for retention and query.
- Baseline the normal request rate and parameter length for /edit-pig.php and alert on statistical anomalies.
- Monitor for repeated 500-series HTTP responses from the endpoint, which often accompany injection probing.
How to Mitigate CVE-2024-10759
Immediate Actions Required
- Restrict network access to the Farm Management System to trusted networks or place it behind a VPN until a fix is applied.
- Disable or protect the /edit-pig.php endpoint with additional authentication and input filtering at the reverse proxy layer.
- Rotate credentials for any accounts that could reach the application and review database user privileges to enforce least privilege.
Patch Information
No vendor advisory or official patch has been published in the referenced sources at the time of writing. Consult VulDB #282928 and the IT Source Code project page for updates. If no patch becomes available, replace concatenated SQL in /edit-pig.php with parameterized queries using PHP Data Objects (PDO) or mysqli prepared statements.
Workarounds
- Apply WAF rules that reject requests to /edit-pig.php containing SQL syntax tokens in the affected parameters.
- Enforce server-side input validation that constrains pigno, weight, and arrived to numeric or date formats and status to an allow-list of values.
- Reduce the database account privileges used by the application to prevent schema modification and cross-database access.
- Remove the application from public exposure if it is not required for external use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
