CVE-2024-1924: Codeastro Membership Management SQL Injection

CVE-2024-1924 Overview

CVE-2024-1924 is a SQL injection vulnerability in CodeAstro Membership Management System 1.0. The flaw resides in the /get_membership_amount.php script, where the membershipTypeId parameter is passed to a backend query without sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The issue is tracked as VulDB entry VDB-254859 and maps to [CWE-89]. Public disclosure of the exploit has occurred, increasing the risk of opportunistic abuse against exposed instances.

Critical Impact
Unauthenticated attackers can inject SQL commands through the membershipTypeId parameter to read data from the underlying database over the network.

Affected Products

CodeAstro Membership Management System 1.0
/get_membership_amount.php endpoint
Deployments exposing the application to untrusted networks

Discovery Timeline

2024-02-27 - CVE-2024-1924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1924

Vulnerability Analysis

The vulnerability is a classic SQL injection ([CWE-89]) in a PHP script handling membership lookups. When a client requests /get_membership_amount.php, the application accepts a membershipTypeId argument and concatenates it into a database query. Because the parameter is not validated or bound as a prepared statement, attacker-controlled SQL syntax reaches the database engine.

Exploitation requires no authentication and no user interaction. The attack is launched over the network against any reachable instance of the application. According to the CVSS metrics recorded in NVD, impact is limited to confidentiality, meaning data disclosure is the primary risk rather than data modification or service disruption. The EPSS score is 0.475%.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The membershipTypeId parameter is inserted directly into a query string without parameterization or input validation, allowing SQL metacharacters such as single quotes, UNION, and comment sequences to alter query semantics.

Attack Vector

An attacker sends an HTTP request to /get_membership_amount.php supplying a crafted membershipTypeId value. Typical payloads use UNION SELECT statements or boolean-based conditions to extract data from other tables, including credentials or personally identifiable information stored in the membership database. Public exploit details for this endpoint are referenced in the GitHub SQL Injection Guide and VulDB #254859.

No verified proof-of-concept code is republished here. Refer to the linked advisories for technical details of the injection strings observed.

Detection Methods for CVE-2024-1924

Indicators of Compromise

HTTP requests to /get_membership_amount.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the membershipTypeId parameter
Unusual database error messages returned to clients or logged by the PHP application
Bursts of requests to the same endpoint from a single source with varying parameter values

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL metacharacters in query string parameters targeting /get_membership_amount.php
Enable database query logging and alert on statements with unexpected UNION operations against membership tables
Correlate web server access logs with database audit trails to identify parameter tampering patterns

Monitoring Recommendations

Track outbound data volumes from the database server for anomalies indicating bulk extraction
Monitor authentication tables for read access originating from the membership application context
Alert on repeated 500-series responses from /get_membership_amount.php, which often indicate probing

How to Mitigate CVE-2024-1924

Immediate Actions Required

Restrict network access to the CodeAstro Membership Management System 1.0 application until a fix is in place
Place the affected endpoint behind a WAF with SQL injection signatures enabled
Audit the database account used by the application and remove privileges beyond what the workflow requires

Patch Information

No vendor patch is referenced in the NVD entry or associated advisories at the time of publication. Operators should contact CodeAstro directly for an updated release and monitor the VulDB CTI Report #254859 for status changes.

Workarounds

Modify /get_membership_amount.php to use parameterized queries or prepared statements for the membershipTypeId value
Cast membershipTypeId to an integer before use, since it represents a numeric identifier
Apply strict input validation that rejects any non-digit characters before the value reaches the database layer

bash

# Example server-side hardening: reject non-numeric membershipTypeId at the web tier
# nginx snippet
location = /get_membership_amount.php {
    if ($arg_membershipTypeId !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}