CVE-2024-3000: Anisha Online Book System SQLi Vulnerability

CVE-2024-3000 Overview

CVE-2024-3000 is a SQL injection vulnerability in code-projects Online Book System 1.0 affecting the /index.php file. Attackers can manipulate the username, password, login_username, or login_password parameters to inject arbitrary SQL statements. The flaw maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and is remotely exploitable without authentication or user interaction. Public disclosure of the exploit technique increases the risk of opportunistic attacks against unpatched deployments.

Critical Impact
Unauthenticated remote attackers can extract or modify database contents and bypass authentication by injecting SQL through login parameters in /index.php.

Affected Products

Anisha Online Book System 1.0
code-projects Online Book System (distribution of the same codebase)
Deployments exposing /index.php login endpoint

Discovery Timeline

2024-03-27 - CVE-2024-3000 published to NVD
2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-3000

Vulnerability Analysis

The vulnerability resides in the login handling logic of /index.php within Online Book System 1.0. User-supplied values for username, password, login_username, and login_password are concatenated into SQL queries without parameterization or sanitization. An attacker can submit crafted input that alters the query's logical structure, producing authentication bypass or arbitrary data retrieval. The public exploit demonstrates authentication bypass against the login form, granting access without valid credentials.

Because the attack targets a pre-authentication endpoint, no prior account or session is required. Successful exploitation yields confidentiality, integrity, and availability impact against the backend database. See the GitHub CVE Analysis for the proof-of-concept payload.

Root Cause

The root cause is the construction of SQL statements through string concatenation with untrusted HTTP request parameters. The application does not use prepared statements, parameter binding, or input validation on login fields. This permits SQL metacharacters such as single quotes and boolean operators to terminate the intended query context and append attacker-controlled clauses.

Attack Vector

The attack vector is network-based over HTTP(S) against the public-facing login endpoint. An attacker submits a POST request to /index.php with malicious payloads in the targeted parameters. Typical payloads use tautology-based injection (for example, ' OR '1'='1) to bypass authentication, or UNION SELECT statements to exfiltrate database rows. No special tooling beyond a standard HTTP client is required.

The vulnerability mechanism is documented in the public proof-of-concept and the VulDB entry #258202. No code example is reproduced here; see the referenced advisories for technical details.

Detection Methods for CVE-2024-3000

Indicators of Compromise

HTTP POST requests to /index.php containing SQL metacharacters such as ', --, #, OR 1=1, or UNION SELECT in username, password, login_username, or login_password parameters
Successful authentications immediately following malformed login submissions from the same source IP
Unexpected database errors in web server or PHP logs referencing the login query
Outbound traffic from the database host to unusual destinations following login activity

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns on the login endpoint
Correlate web access logs with database query logs to identify anomalous SELECT or UNION activity tied to login requests
Hunt for repeated failed logins followed by a successful one without a credential reset event
Inspect HTTP request bodies for encoded SQL keywords (URL-encoded %27, %20OR%20) targeting the listed parameters

Monitoring Recommendations

Enable verbose logging on the web server and PHP error handler for the /index.php endpoint
Monitor database accounts used by the application for read access to tables unrelated to authentication
Alert on spikes in 500-series HTTP responses from the login page, which often indicate injection probing
Track authentication anomalies such as logins from new geolocations or non-browser user agents

How to Mitigate CVE-2024-3000

Immediate Actions Required

Remove the Online Book System 1.0 application from public network exposure until a fix is applied
Rewrite the affected login queries in /index.php to use parameterized queries (mysqli_prepare or PDO with bound parameters)
Rotate database credentials and review recent authentication logs for signs of bypass
Audit application database tables for unauthorized modifications or data exfiltration

Patch Information

No vendor patch is listed in the NVD or VulDB references at the time of publication. Administrators should treat the codebase as unmaintained and apply manual code fixes. Replace string-concatenated SQL with prepared statements across all authentication and data access functions, and validate input types and lengths server-side. Consult the VulDB CTI #258202 entry for updated disclosure status.

Workarounds

Place the application behind a WAF with managed SQL injection rulesets blocking requests to /index.php containing injection signatures
Restrict access to the application using network ACLs, VPN, or IP allow-listing during remediation
Apply least-privilege permissions to the database account, removing DDL and write access where not required
Disable the application entirely and migrate to a maintained alternative if patching is not feasible

bash

# Example ModSecurity rule blocking SQLi patterns on the login endpoint
SecRule REQUEST_URI "@streq /index.php" \
    "phase:2,chain,deny,status:403,id:1003000,msg:'CVE-2024-3000 SQLi attempt'"
    SecRule ARGS:username|ARGS:password|ARGS:login_username|ARGS:login_password \
        "@detectSQLi" "t:none,t:urlDecodeUni"