CVE-2024-1878: Employee Management System SQLi Vulnerability

CVE-2024-1878 Overview

CVE-2024-1878 is a SQL injection vulnerability in SourceCodester Employee Management System 1.0, developed by Razormist. The flaw resides in the /myprofile.php script, where the id parameter is passed directly into a database query without proper sanitization. An authenticated attacker can inject payloads such as 1 or 1=1 to manipulate query logic and access or modify arbitrary employee records. The issue is tracked under VDB-254726 and has been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Remote attackers with low-privileged accounts can extract, modify, or destroy database contents by injecting SQL through the id parameter of /myprofile.php.

Affected Products

Razormist Employee Management System 1.0
SourceCodester Employee Management System 1.0
Deployments matching CPE cpe:2.3:a:razormist:employee_management_system:1.0

Discovery Timeline

2024-02-26 - CVE-2024-1878 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1878

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the myprofile.php endpoint of the Employee Management System. The id query-string parameter is concatenated into a backend SQL statement without parameterization or input validation. Supplying the payload 1 or 1=1 demonstrates the flaw by forcing the WHERE clause to always evaluate true, returning records outside the caller's authorization scope. Because the attack requires only network access and a low-privileged session, exploitation is straightforward using standard HTTP tooling.

Beyond record enumeration, an attacker can chain UNION-based or time-based blind techniques to exfiltrate credentials, session tokens, and other sensitive tables. Depending on database permissions, write operations against employee data are also possible.

Root Cause

The root cause is the direct interpolation of user-controlled input into an SQL query string. The application does not use prepared statements or input allow-listing, and it does not enforce object-level authorization on the id parameter. This combination also introduces an Insecure Direct Object Reference condition alongside the injection primitive.

Attack Vector

Exploitation occurs over the network against the vulnerable web application. An attacker sends a crafted GET request to /myprofile.php?id=<payload>, where <payload> contains SQL syntax such as 1%20or%201=1. No user interaction is required, and the exploit disclosure means proof-of-concept requests are already publicly documented in the referenced GitHub IDOR Vulnerability Report.

No verified code examples are available from upstream sources. Refer to the VulDB entry #254726 for additional technical context.

Detection Methods for CVE-2024-1878

Indicators of Compromise

HTTP requests to /myprofile.php containing SQL metacharacters in the id parameter, such as or, union, select, single quotes, or comment sequences (--, #).
Unexpected 200 responses to myprofile.php requests where the id value is non-numeric or URL-encoded (for example, 1%20or%201=1).
Web server access logs showing repeated id parameter enumeration from a single source IP within a short window.

Detection Strategies

Deploy web application firewall signatures that match tautology-based SQL injection patterns targeting the id parameter.
Instrument the application database to log queries against employee tables and alert when identical statements return abnormally large result sets.
Correlate authentication events with subsequent access to /myprofile.php to identify low-privileged accounts pivoting to other user records.

Monitoring Recommendations

Enable verbose HTTP request logging on the web server and forward logs to a central SIEM for query-parameter inspection.
Track database error rates and syntax exceptions originating from the PHP application, which often indicate active injection probing.
Baseline normal traffic to /myprofile.php and alert on deviations in request rate, parameter length, or character distribution.

How to Mitigate CVE-2024-1878

Immediate Actions Required

Restrict network access to the Employee Management System, allowing connections only from trusted management networks until a fix is applied.
Disable or gate /myprofile.php behind additional authentication and authorization checks if the application must remain reachable.
Rotate credentials for any database accounts used by the application, assuming they may have been exposed via prior exploitation attempts.

Patch Information

No official vendor patch has been published for Razormist Employee Management System 1.0 at the time of this writing. Organizations running this application should treat it as unmaintained and consider migration to a supported employee management platform. Monitor the vendor's public repositories and the VulDB CTI entry #254726 for future updates.

Workarounds

Refactor myprofile.php to use parameterized queries (PDO::prepare with bound parameters or mysqli_prepare) and remove all string concatenation of user input into SQL statements.
Cast the id parameter to an integer at the application layer before use, rejecting any non-numeric input with an HTTP 400 response.
Enforce object-level authorization so that a session can only retrieve its own profile record, regardless of the id value supplied.
Deploy a WAF rule to block requests where the id query parameter contains non-numeric characters.

bash

# Example ModSecurity rule blocking non-numeric id values on /myprofile.php
SecRule REQUEST_URI "@beginsWith /myprofile.php" \
    "phase:2,chain,deny,status:400,id:1002024,msg:'CVE-2024-1878 SQLi guard'"
    SecRule ARGS:id "!@rx ^[0-9]+$" "t:none,t:urlDecodeUni"