CVE-2024-2283: Boyiddha Automated-Mess SQLi Vulnerability

CVE-2024-2283 Overview

CVE-2024-2283 is a SQL injection vulnerability in Boyiddha Automated-Mess-Management-System 1.0. The flaw resides in the /member/view.php script, where the date parameter is concatenated into a SQL query without proper sanitization. Remote attackers can exploit this issue without authentication or user interaction. The vulnerability maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Public exploit details have been disclosed, increasing the risk of opportunistic attacks against exposed deployments. The vendor was contacted prior to disclosure but did not respond, and no official patch is available.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the date parameter of /member/view.php, leading to full disclosure, modification, or deletion of backend database contents.

Affected Products

Boyiddha Automated-Mess-Management-System 1.0
Component: /member/view.php
CPE: cpe:2.3:a:boyiddha:automated-mess-management-system:1.0

Discovery Timeline

2024-03-08 - CVE-2024-2283 published to NVD
2025-03-12 - Last updated in NVD database

Technical Details for CVE-2024-2283

Vulnerability Analysis

The vulnerability exists in the member view component of the Automated-Mess-Management-System web application. The /member/view.php script accepts a date parameter from the HTTP request and incorporates the value directly into a SQL statement. Because the input is neither parameterized nor escaped, attackers can append arbitrary SQL syntax to alter the executed query. The attack requires no privileges and no user interaction, and it can be performed remotely over the network. Successful exploitation grants full read and write access to the underlying database, exposing member records, credentials, and operational data. Because the vendor has not responded to disclosure, no official fix exists for affected installations.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The application builds its query through string concatenation rather than using prepared statements or parameterized queries. The date parameter is treated as trusted input, allowing typical SQL injection payloads such as UNION-based extraction, boolean-based blind injection, and stacked queries to succeed.

Attack Vector

An attacker sends a crafted HTTP request to /member/view.php with a malicious date parameter value. The injected SQL executes within the database session used by the PHP application. Depending on database privileges, attackers can enumerate schemas, dump tables, modify records, or in some configurations write files to disk. The exploit has been publicly documented in a GitHub PoC repository and tracked as VulDB #256050.

No verified exploit code is reproduced here. Refer to the published advisory for the technical proof-of-concept against the date parameter.

Detection Methods for CVE-2024-2283

Indicators of Compromise

HTTP requests to /member/view.php containing SQL metacharacters such as ', ", --, UNION, SELECT, OR 1=1, or URL-encoded equivalents in the date parameter.
Web server access logs showing unusually long or repeated date parameter values from a single source IP.
Database error messages or HTTP 500 responses returned from /member/view.php requests.
Unexpected INFORMATION_SCHEMA queries or large SELECT operations originating from the application database user.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the date parameter on /member/view.php for SQL injection signatures.
Enable database query logging and alert on queries containing UNION statements or comment sequences sourced from the application account.
Correlate web access logs with database audit logs to identify injection attempts that reach the SQL engine.

Monitoring Recommendations

Monitor for outbound data transfers from the database server that exceed normal baselines, which may indicate table dumping.
Track authentication failures and member account changes that follow suspicious /member/view.php requests.
Forward web server, PHP error, and database logs to a centralized SIEM for unified detection and retention.

How to Mitigate CVE-2024-2283

Immediate Actions Required

Restrict access to the Automated-Mess-Management-System application to trusted internal networks or VPN users until a fix is available.
Place the application behind a WAF configured with SQL injection rule sets targeting the date parameter of /member/view.php.
Rotate database credentials used by the application and reduce database user privileges to the minimum required.
Audit the database for signs of prior compromise, including unauthorized records, dropped tables, or new privileged users.

Patch Information

No official patch is available. The vendor was contacted before public disclosure but did not respond. Organizations using Boyiddha Automated-Mess-Management-System 1.0 should consider decommissioning the application or applying source-level fixes by replacing concatenated SQL with parameterized queries (PDO with bound parameters or mysqli prepared statements) in /member/view.php and any other scripts that handle user input.

Workarounds

Modify /member/view.php to validate that the date parameter matches a strict date format such as YYYY-MM-DD before use in any query.
Replace dynamic SQL string construction with prepared statements that bind the date value as a typed parameter.
Apply database-layer least privilege so the application account cannot read sensitive tables or execute administrative statements.

bash

# Example PHP fix using PDO prepared statements
$stmt = $pdo->prepare('SELECT * FROM members WHERE date = :date');
$stmt->bindValue(':date', $_GET['date'], PDO::PARAM_STR);
$stmt->execute();