CVE-2024-2393: CRUD Without Page Reload SQLi Vulnerability

CVE-2024-2393 Overview

A critical SQL injection vulnerability has been identified in SourceCodester CRUD without Page Reload version 1.0. This vulnerability exists in the add_user.php file, where improper handling of the city parameter allows attackers to inject malicious SQL queries. The vulnerability can be exploited remotely without authentication, potentially leading to complete database compromise.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially resulting in unauthorized data access, data modification, or complete database takeover.

Affected Products

• SourceCodester CRUD without Page Reload/Refresh version 1.0
• Applications utilizing the add_user.php functionality
• PHP/MySQL implementations based on this SourceCodester package

Discovery Timeline

• 2024-03-12 - CVE-2024-2393 published to NVD
• 2025-02-18 - Last updated in NVD database

Technical Details for CVE-2024-2393

Vulnerability Analysis

This vulnerability represents a classic SQL injection flaw in a PHP web application. The add_user.php file fails to properly sanitize user-supplied input in the city parameter before incorporating it into SQL queries. When user data is passed directly to the database without validation or parameterized queries, attackers can manipulate the SQL statement structure to execute unauthorized commands.

The attack requires no authentication and can be executed remotely over the network. Successful exploitation could allow an attacker to read sensitive data from the database, modify or delete existing records, execute administrative operations, and in some configurations, gain access to the underlying operating system.

Root Cause

The root cause of this vulnerability is the lack of input validation and the use of unsafe SQL query construction in the add_user.php file. The application directly concatenates user-supplied input from the city parameter into SQL queries without using prepared statements or parameterized queries, which are the standard defenses against SQL injection attacks.

Attack Vector

The attack can be launched remotely over the network against web applications running the vulnerable software. An attacker would craft malicious input containing SQL syntax within the city parameter when submitting data to the add_user.php endpoint. The exploit has been publicly disclosed, increasing the risk of widespread exploitation.

The vulnerability manifests when user input is processed by the add_user.php script. Attackers can inject SQL commands through the city parameter, manipulating the intended query logic. For detailed technical information about the exploitation technique, refer to the GitHub Source Code Repository containing the vulnerability disclosure.

Detection Methods for CVE-2024-2393

Indicators of Compromise

• Unusual SQL error messages in web server logs referencing add_user.php
• HTTP requests to add_user.php containing SQL keywords or special characters (e.g., ', --, UNION, SELECT) in the city parameter
• Database logs showing unexpected queries or access patterns
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to add_user.php
• Monitor HTTP request logs for suspicious payloads targeting the city parameter with SQL injection signatures
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
• Use intrusion detection systems (IDS) with SQL injection detection signatures

Monitoring Recommendations

• Enable detailed logging for the web application and database server
• Set up alerts for failed SQL queries or syntax errors that may indicate injection attempts
• Monitor for unusual database account activity or privilege escalation attempts
• Implement real-time log analysis to correlate suspicious web requests with database activity

How to Mitigate CVE-2024-2393

Immediate Actions Required

• Remove or disable the vulnerable add_user.php functionality until a patch is applied
• Implement input validation on all user-supplied parameters, especially the city field
• Deploy Web Application Firewall (WAF) rules to block SQL injection attempts
• Review database privileges to ensure the web application uses least-privilege access

Patch Information

No official patch has been released by the vendor at this time. Organizations using SourceCodester CRUD without Page Reload should implement the workarounds listed below and consider migrating to alternative, actively maintained software. Monitor the VulDB advisory for updates regarding patches or vendor responses.

Workarounds

• Replace dynamic SQL queries with prepared statements or parameterized queries in add_user.php
• Implement strict input validation to whitelist allowed characters for the city parameter
• Deploy a WAF with SQL injection protection enabled in front of the application
• Restrict network access to the application to trusted IP ranges where possible

# Example: Restrict access to add_user.php using Apache configuration
<Files "add_user.php">
    Order Deny,Allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Files>