CVE-2024-2517: Online Event Hall Reservation SQLi Flaw

CVE-2024-2517 Overview

CVE-2024-2517 is a SQL injection vulnerability in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. The flaw resides in the book_history.php file, where the del_id parameter is passed to a database query without proper sanitization. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed and is tracked as VulDB identifier 256954. The vendor was contacted prior to disclosure but did not respond. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can extract, modify, or delete database contents through the vulnerable del_id parameter in book_history.php.

Affected Products

• MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0
• Component: book_history.php
• Vulnerable parameter: del_id

Discovery Timeline

• 2024-03-16 - CVE-2024-2517 published to NVD
• 2025-02-14 - Last updated in NVD database

Technical Details for CVE-2024-2517

Vulnerability Analysis

The vulnerability is a blind SQL injection in the book_history.php script of the Online-College-Event-Hall-Reservation-System web application. The application accepts the del_id request parameter and concatenates it directly into a SQL query without parameterized statements or input validation. Attackers can append boolean-based or time-based payloads to infer database contents one bit at a time. According to the published proof-of-concept, the vulnerability is exploitable remotely over HTTP without authentication or user interaction.

Root Cause

The root cause is improper neutralization of user-supplied input in a SQL statement [CWE-89]. The del_id parameter, intended to identify a booking record for deletion, is interpolated into the query string rather than bound as a prepared statement parameter. Because the application performs no type casting, allow-list validation, or escaping, attacker-controlled characters such as single quotes, comments, and conditional operators become part of the executed SQL.

Attack Vector

An attacker sends a crafted HTTP request to the book_history.php endpoint, supplying a malicious value in the del_id parameter. Because the application does not require authentication for the affected code path, exploitation requires only network reachability to the web server. Successful exploitation enables disclosure of database tables containing reservation data and any stored credentials, as well as potential modification or destruction of records.

No verified code examples are available. See the GitHub PoC for Blind SQL Injection for technical details and the VulDB entry #256954 for additional context.

Detection Methods for CVE-2024-2517

Indicators of Compromise

• HTTP requests to book_history.php containing SQL metacharacters in the del_id parameter, such as single quotes, UNION, SLEEP(, BENCHMARK(, or inline comments (--, #, /*).
• Web server access logs showing repeated requests to book_history.php with incrementally varying del_id values consistent with boolean-based blind extraction.
• Database error messages or unusually long response times correlated with requests to book_history.php.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect the del_id parameter and block requests containing SQL syntax tokens.
• Enable database query logging and alert on queries originating from the reservation system that contain OR 1=1, UNION SELECT, or time-delay functions.
• Perform authenticated dynamic application security testing (DAST) against the book_history.php endpoint to confirm the presence of the flaw.

Monitoring Recommendations

• Correlate web server, application, and database telemetry to identify multi-stage injection attempts targeting reservation endpoints.
• Alert on outbound database connections or large result sets returned to the web tier outside normal usage baselines.
• Track HTTP 500 responses from book_history.php as a potential signal of failed injection probing.

How to Mitigate CVE-2024-2517

Immediate Actions Required

• Restrict network exposure of the Online-College-Event-Hall-Reservation-System to trusted networks or place it behind authenticated reverse-proxy access until a fix is available.
• Apply WAF signatures that block SQL metacharacters in the del_id parameter of book_history.php.
• Review web server and database logs for prior exploitation indicators and rotate any credentials stored in the application database.

Patch Information

No vendor patch is available. The vendor was contacted before public disclosure and did not respond, per the VulDB advisory. Organizations running MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 should evaluate migrating to a maintained reservation platform or forking the codebase to apply input validation locally.

Workarounds

• Modify book_history.php to cast del_id to an integer before use, for example using intval() in PHP, or reject non-numeric input entirely.
• Refactor the affected query to use PDO or mysqli prepared statements with bound parameters instead of string concatenation.
• Enforce least-privilege database accounts so the web application cannot perform DROP, ALTER, or cross-database queries.

# Example hardening: cast del_id to integer before query execution
# In book_history.php, replace direct interpolation with:
#   $del_id = (int) $_GET['del_id'];
#   $stmt = $pdo->prepare('DELETE FROM bookings WHERE id = :id');
#   $stmt->execute([':id' => $del_id]);