CVE-2024-1821: Crime Reporting System SQL Injection Flaw

CVE-2024-1821 Overview

CVE-2024-1821 is a SQL injection vulnerability in code-projects Crime Reporting System 1.0. The flaw resides in the police_add.php script, where the police_name, police_id, police_spec, and password parameters are passed directly into database queries without sanitization. Authenticated attackers can manipulate these arguments to inject arbitrary SQL statements. The exploit has been publicly disclosed under VulDB identifier VDB-254609 and may be used by opportunistic attackers. The weakness maps to [CWE-89: Improper Neutralization of Special Elements used in an SQL Command].

Critical Impact
Authenticated attackers can inject arbitrary SQL through police_add.php to read, modify, or destroy the underlying database, compromising confidentiality, integrity, and availability of the Crime Reporting System.

Affected Products

code-projects Crime Reporting System 1.0
CPE: cpe:2.3:a:code-projects:crime_reporting_system:1.0
Component: police_add.php

Discovery Timeline

2024-02-23 - CVE-2024-1821 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1821

Vulnerability Analysis

The vulnerability exists in the officer-registration workflow of the Crime Reporting System. When a user submits data to police_add.php, the application concatenates the police_name, police_id, police_spec, and password request parameters directly into a SQL INSERT statement. No prepared statements, parameter binding, or input validation are applied.

An attacker with low-privilege access to the application can supply crafted values containing SQL metacharacters. The injected payload executes with the privileges of the database user configured for the application. Because the flaw impacts a write endpoint, attackers can also leverage stacked queries or subqueries to exfiltrate or modify records across other tables in the schema.

Exploitation requires network access to the vulnerable application and a low-privilege authenticated session. No user interaction is required beyond submitting the crafted form.

Root Cause

The root cause is unsafe SQL construction in police_add.php. The developer built dynamic queries via string concatenation using unsanitized HTTP request parameters. The absence of parameterized queries or an ORM abstraction allows attacker-controlled input to alter query structure rather than serve as literal data.

Attack Vector

The attacker authenticates to the Crime Reporting System, navigates to the officer add function, and submits a crafted POST request to police_add.php. By inserting SQL syntax such as quote characters and boolean expressions into the police_id or password fields, the attacker breaks out of the intended query context. The technical write-up is available in the GitHub SQL Injection Report and the VulDB entry #254609.

No verified exploitation code is reproduced here. See the referenced advisory for the sanitized proof-of-concept payload.

Detection Methods for CVE-2024-1821

Indicators of Compromise

POST requests to police_add.php containing SQL metacharacters such as ', --, /*, UNION, SELECT, or OR 1=1 in the police_name, police_id, police_spec, or password parameters.
Web server access logs showing unusually long parameter values or encoded payloads targeting the officer registration endpoint.
Unexpected new rows in the police officer table or modifications to unrelated tables following requests to police_add.php.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns against police_add.php request parameters.
Enable database query logging and alert on statements originating from the application that contain tautologies, UNION clauses, or comments injected into INSERT operations.
Correlate authentication events with subsequent anomalous parameter values on the officer registration endpoint to catch low-privilege abuse.

Monitoring Recommendations

Monitor the application database for schema-level changes, unauthorized privilege grants, and unexpected data exports from the police records tables.
Track failed and successful logins that immediately precede POST activity to police_add.php to identify credential reuse or brute-force precursors.
Baseline normal parameter length and character composition for the officer registration form and alert on deviations.

How to Mitigate CVE-2024-1821

Immediate Actions Required

Restrict access to the Crime Reporting System administrative interfaces to trusted internal networks or VPN users only.
Rotate all application and database credentials, especially if the system was internet-exposed.
Audit the police officer table and related records for unauthorized entries or modifications since deployment.
Deploy WAF rules blocking SQL metacharacters in requests to police_add.php until code fixes are applied.

Patch Information

No official vendor patch is listed for code-projects Crime Reporting System 1.0. Consumers of this codebase should manually remediate police_add.php by replacing string-concatenated queries with prepared statements using PDO or mysqli parameter binding, and by applying server-side input validation on all form fields.

Workarounds

Disable the police_add.php endpoint if the officer registration function is not actively used.
Enforce strict allowlist validation on police_id (numeric only) and length limits on police_name and police_spec at a reverse proxy or WAF layer.
Run the application database account with least privilege, removing DROP, ALTER, and cross-database access rights.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on police_add.php
SecRule REQUEST_URI "@endsWith /police_add.php" \
  "phase:2,chain,deny,status:403,id:1002024,\
   msg:'Potential SQLi against Crime Reporting System (CVE-2024-1821)'"
  SecRule ARGS:police_name|ARGS:police_id|ARGS:police_spec|ARGS:password \
    "@rx (?i)(\bunion\b.*\bselect\b|--|/\*|\bor\b\s+1=1|;)"