CVE-2024-1877: Employee Management System SQL Injection

CVE-2024-1877 Overview

CVE-2024-1877 is a SQL injection vulnerability in SourceCodester Employee Management System 1.0, developed by razormist. The flaw exists in the /cancel.php script, where the id parameter is passed directly into a SQL query without sanitization. An authenticated remote attacker can inject payloads such as 1 or 1=1 to manipulate the query and access or modify database records. The exploit has been publicly disclosed under identifier VDB-254725, increasing exposure risk for unpatched deployments. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Attackers with low privileges can extract, alter, or destroy database contents over the network, compromising confidentiality, integrity, and availability of employee data.

Affected Products

razormist Employee Management System 1.0
SourceCodester Employee Management System 1.0
cancel.php endpoint handling the id GET parameter

Discovery Timeline

2024-02-26 - CVE-2024-1877 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1877

Vulnerability Analysis

The vulnerability resides in the leave cancellation workflow of the Employee Management System. The /cancel.php script accepts an id parameter from the query string and concatenates it into a backend SQL statement without prepared statements or input validation. Supplying a payload such as 1%20or%201=1 alters the WHERE clause and causes the query to match arbitrary rows.

Because the injection point is a numeric identifier, attackers can chain additional SQL syntax to perform UNION-based data extraction, boolean-based blind extraction, or destructive operations such as UPDATE and DELETE. Authenticated access to the application is required, but any low-privileged user session is sufficient to reach the vulnerable endpoint.

Root Cause

The root cause is direct string concatenation of untrusted input into a SQL query, without parameterized queries, type casting, or allow-list validation. This is a textbook [CWE-89] pattern common in legacy PHP applications that build queries dynamically from $_GET or $_REQUEST values.

Attack Vector

Exploitation requires network access to the web application and a valid low-privileged account. An attacker issues a crafted HTTP GET request to /cancel.php?id=1%20or%201=1 or a similar payload. Refer to the public exploit writeup on GitHub and the VulDB #254725 entry for the disclosed proof of concept.

No verified sanitized code sample is available in the source data, so exploitation details are described in prose only.

Detection Methods for CVE-2024-1877

Indicators of Compromise

HTTP requests to /cancel.php containing SQL keywords such as or, union, select, sleep, or tautologies like 1=1 in the id parameter.
URL-encoded injection markers such as %20or%20, %27, %22, or -- appearing in id query strings.
Unexpected leave-cancellation records or mass modification of employee records in the application database.
Web server access logs showing repeated /cancel.php?id= requests from a single source with varying payload lengths.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL metacharacters and boolean tautologies in the id parameter.
Enable database query logging and alert on queries against the leave or employee tables containing suspicious OR 1=1 patterns.
Correlate authenticated session activity with anomalous row counts returned from cancel.php-related queries.

Monitoring Recommendations

Ingest web server, application, and database logs into a centralized analytics platform for correlation.
Baseline normal parameter values for /cancel.php?id= and alert on deviations in length, character set, or frequency.
Track authenticated user sessions that trigger multiple failed or malformed cancellation requests within short intervals.

How to Mitigate CVE-2024-1877

Immediate Actions Required

Restrict access to the Employee Management System to trusted internal networks or VPN users until a fix is deployed.
Audit the application database for unauthorized modifications to leave and employee tables.
Rotate credentials for any accounts that have accessed the application, and review web server logs for prior exploitation attempts.

Patch Information

No vendor advisory or official patch has been published for razormist Employee Management System 1.0 in the referenced sources. Organizations running this application should treat it as unpatched and consider retiring or replacing it. Track updates through the VulDB #254725 CTI entry.

Workarounds

Replace vulnerable query construction in cancel.php with parameterized queries or prepared statements using PDO or mysqli bound parameters.
Enforce strict server-side type validation, casting the id parameter to an integer before it reaches any SQL statement.
Deploy a WAF with SQL injection signatures in front of the application and block requests containing SQL metacharacters in numeric parameters.
Apply least-privilege database accounts so the application user cannot execute DROP, ALTER, or cross-schema queries.

bash

# Example WAF rule concept (ModSecurity) to block SQLi in the id parameter
SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|or\s+1=1|--|;|/\*)" \
    "id:1002024,phase:2,deny,status:403,log,msg:'Possible SQLi in cancel.php id parameter'"