CVE-2024-2516: Event Hall Reservation System SQLi Vulnerability

CVE-2024-2516 Overview

CVE-2024-2516 is a SQL injection vulnerability [CWE-89] in MAGESH-K21 Online-College-Event-Hall-Reservation-System version 1.0. The flaw resides in the home.php file, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements against the backend database.

The exploit has been publicly disclosed, and the attack can be launched remotely over the network. According to the reporter, the vendor was contacted but did not respond to the disclosure. The vulnerability is tracked as VulDB entry #256953.

Critical Impact
Remote authenticated attackers can extract, modify, or delete database records by injecting SQL through the id parameter in home.php, compromising confidentiality, integrity, and availability of the reservation system.

Affected Products

MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0
Component: home.php (vulnerable id parameter)
CPE: cpe:2.3:a:magesh-k21:online-college-event-hall-reservation-system:1.0

Discovery Timeline

2024-03-16 - CVE-2024-2516 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2516

Vulnerability Analysis

The vulnerability is a blind SQL injection in the home.php script of the Online-College-Event-Hall-Reservation-System. The application concatenates the user-controlled id request parameter directly into an SQL query without parameterization or input validation. As a result, attackers control the structure of the executed SQL statement.

Because the flaw is blind, attackers infer database contents through boolean-based or time-based payloads rather than direct output. Successful exploitation exposes stored user credentials, reservation data, and administrative records. The attacker can also modify or destroy database contents, affecting the availability of the application.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The home.php handler builds a query string using the id parameter received from the HTTP request without applying prepared statements, parameter binding, or input sanitization functions such as mysqli_real_escape_string.

Attack Vector

Exploitation requires network access to the application and low-privilege authentication. An attacker submits a crafted HTTP request with a malicious payload in the id parameter, for example a boolean-based payload like id=1 AND SLEEP(5) or a UNION-based payload extracting column data. No user interaction is required, and the attack can be automated with tooling such as sqlmap.

Refer to the published proof-of-concept for payload examples: GitHub CVE Analysis.

Detection Methods for CVE-2024-2516

Indicators of Compromise

HTTP requests to home.php containing SQL keywords in the id parameter such as UNION, SELECT, SLEEP, BENCHMARK, or tautologies like 1=1.
Unusually long response times for home.php requests, indicating time-based blind SQL injection.
Database error messages or stack traces referencing the id parameter in web server logs.
Requests originating from known SQL injection tools identified by user-agent strings such as sqlmap.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set targeting SQL injection signatures on requests to home.php.
Enable database query logging and alert on queries containing anomalous concatenations of the id parameter.
Correlate web server access logs with database audit logs to identify malformed queries triggered by suspicious HTTP requests.

Monitoring Recommendations

Monitor authentication logs for unusual data exfiltration patterns following successful login events.
Track query response time distributions on the reservation database to identify time-based injection attempts.
Alert on outbound data volume anomalies from the application server that may indicate mass data extraction.

How to Mitigate CVE-2024-2516

Immediate Actions Required

Restrict network exposure of the Online-College-Event-Hall-Reservation-System to trusted networks or place it behind a VPN.
Deploy WAF rules to block SQL injection payloads targeting the id parameter in home.php.
Rotate database credentials and audit the database for signs of unauthorized access or modification.
Enforce the principle of least privilege on the database user account used by the application.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations using this software should consider discontinuing its use or applying source-code fixes to home.php to use parameterized queries. The application appears to be an academic project rather than a maintained commercial product.

Workarounds

Modify home.php to use prepared statements with parameter binding via mysqli_prepare or PDO with placeholders.
Apply strict server-side validation to ensure the id parameter contains only expected numeric values before use.
Remove or disable the vulnerable endpoint if it is not required for business operations.
Migrate to an actively maintained alternative reservation system.

bash

# Example nginx WAF-style block for suspicious id parameter values
location ~ /home\.php$ {
    if ($arg_id ~* "(union|select|sleep|benchmark|--|;|/\*)") {
        return 403;
    }
}