CVE-2024-3000: Anisha Online Book System SQL Injection

CVE-2024-3000 Overview

A critical SQL injection vulnerability has been discovered in code-projects Online Book System version 1.0. This vulnerability exists in the /index.php file and allows remote attackers to perform SQL injection attacks by manipulating the username, password, login_username, and login_password parameters. The exploitation of this flaw enables authentication bypass and potential unauthorized access to the underlying database.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and potentially gain full access to the database, compromising all user credentials and stored data.

Affected Products

• Anisha Online Book System 1.0

Discovery Timeline

• 2024-03-27 - CVE-2024-3000 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-3000

Vulnerability Analysis

This SQL injection vulnerability in Online Book System 1.0 stems from improper input validation in the authentication mechanism. The /index.php file accepts user-supplied input through multiple parameters related to authentication—specifically username, password, login_username, and login_password—without adequate sanitization or parameterization before incorporating these values into SQL queries.

When an attacker supplies specially crafted SQL syntax through these input fields, the application directly concatenates this malicious input into database queries. This allows the attacker to modify the intended SQL logic, effectively bypassing authentication controls or extracting sensitive information from the database.

The exploit has been publicly disclosed, increasing the risk of widespread exploitation against unpatched installations. According to VulDB, this vulnerability has been assigned identifier VDB-258202.

Root Cause

The root cause is the lack of proper input validation and the use of unsafe SQL query construction. The application fails to sanitize user input or utilize parameterized queries (prepared statements), allowing SQL metacharacters to be interpreted as part of the query syntax rather than as data.

Attack Vector

The attack can be initiated remotely over the network without any authentication or user interaction. An attacker can target the login form at /index.php and inject malicious SQL payloads into the authentication fields. Classic authentication bypass payloads such as ' OR '1'='1 can be used to manipulate the query logic, allowing unauthorized access.

The vulnerability mechanism works by exploiting the application's direct string concatenation in SQL queries. When a user submits login credentials, the application constructs a query that checks if the provided username and password match a record in the database. By injecting SQL syntax that evaluates to true (such as OR 1=1), an attacker can satisfy the authentication check without knowing valid credentials. For detailed technical analysis, see the GitHub PoC Repository.

Detection Methods for CVE-2024-3000

Indicators of Compromise

• Unusual or malformed HTTP POST requests to /index.php containing SQL syntax characters such as single quotes, double dashes, OR, UNION, or SELECT in authentication fields
• Authentication log entries showing successful logins from unexpected IP addresses or with malformed usernames
• Database query logs showing anomalous queries or syntax errors from the web application
• Evidence of data exfiltration attempts or unauthorized database dumps

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in login requests
• Implement monitoring for authentication attempts containing SQL metacharacters (', --, ;, OR, UNION)
• Enable detailed logging on the database server to capture and analyze all queries originating from the web application
• Use SentinelOne Singularity to monitor for suspicious process behavior and web shell indicators that may follow a successful SQL injection attack

Monitoring Recommendations

• Monitor access logs for /index.php with anomalous POST request sizes or patterns
• Set up alerts for multiple failed authentication attempts followed by a successful login from the same source
• Review database logs for unauthorized SELECT, INSERT, UPDATE, or DELETE operations
• Implement network traffic analysis to detect potential data exfiltration following authentication bypass

How to Mitigate CVE-2024-3000

Immediate Actions Required

• Take the Online Book System offline or restrict access to trusted IP addresses until the vulnerability is addressed
• Implement input validation on all user-supplied parameters, specifically username, password, login_username, and login_password
• Deploy a Web Application Firewall (WAF) with SQL injection detection rules as an interim protective measure
• Audit database access logs for signs of exploitation and rotate all user credentials if compromise is suspected

Patch Information

No official vendor patch has been identified in the available references. Organizations using Online Book System 1.0 should consider applying manual code fixes to implement parameterized queries, or migrate to a more actively maintained alternative. Monitor VulDB and vendor channels for any future security updates.

Workarounds

• Implement parameterized queries (prepared statements) in the /index.php file to prevent SQL injection
• Add server-side input validation to reject input containing SQL metacharacters in authentication fields
• Deploy network-level access controls to limit who can access the login page
• Consider placing the application behind a reverse proxy with WAF capabilities to filter malicious requests

# Example: Restrict access to the application via firewall (Linux iptables)
# Allow only trusted IP range to access web server
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP