CVE-2024-3002: Anisha Online Book System SQLi Vulnerability

CVE-2024-3002 Overview

A critical SQL Injection vulnerability has been identified in code-projects Online Book System version 1.0. The vulnerability exists within the /description.php file, where improper handling of the ID parameter allows attackers to inject malicious SQL queries. This flaw enables remote attackers to manipulate database queries without requiring any authentication or user interaction, potentially leading to complete database compromise.

Critical Impact

This SQL Injection vulnerability allows unauthenticated remote attackers to extract sensitive data, modify database contents, or potentially achieve complete system compromise through the vulnerable ID parameter in /description.php.

Affected Products

• Anisha Online Book System 1.0

Discovery Timeline

• 2024-03-27 - CVE-2024-3002 published to NVD
• 2025-03-03 - Last updated in NVD database

Technical Details for CVE-2024-3002

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the /description.php file in the Online Book System application. The vulnerability arises from inadequate input validation and sanitization of the ID parameter before it is incorporated into SQL queries. When user-supplied input is directly concatenated into database queries without proper parameterization or escaping, attackers can inject arbitrary SQL commands.

The vulnerability is remotely exploitable without authentication, meaning any external attacker can target internet-facing instances of this application. Successful exploitation could allow attackers to read sensitive information from the database, modify or delete data, bypass authentication mechanisms, or potentially execute administrative operations on the database server.

Root Cause

The root cause of this vulnerability is the direct incorporation of user-controlled input (the ID parameter) into SQL queries without proper sanitization, parameterization, or prepared statements. The application fails to validate that the input conforms to expected data types or patterns, and does not use parameterized queries that would prevent the interpretation of malicious input as SQL commands.

Attack Vector

The attack vector is network-based, allowing remote exploitation through HTTP requests to the vulnerable /description.php endpoint. An attacker crafts a malicious request containing SQL injection payloads in the ID parameter. The vulnerable application processes this input without validation and passes it directly to the database engine, where the injected SQL commands are executed with the application's database privileges.

The attack requires no authentication or special privileges, and no user interaction is necessary. The attacker simply needs network access to the application to send malicious requests. The exploit has been publicly disclosed, making it accessible to potential attackers. For technical details on the exploitation technique, refer to the GitHub SQL Injection PoC and the VulDB CVE Analysis.

Detection Methods for CVE-2024-3002

Indicators of Compromise

• Unusual or malformed requests to /description.php containing SQL keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, DROP, or -- comment sequences
• Database error messages appearing in application logs or HTTP responses indicating failed SQL queries
• Unexpected database queries or access patterns in database audit logs
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting the ID parameter
• Implement application-level logging to capture all requests to /description.php with full parameter details
• Configure database activity monitoring to alert on suspicious query patterns or unusual data access
• Use intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor web server access logs for requests to /description.php with suspicious parameter values
• Set up alerts for database errors that may indicate injection attempts
• Track database query execution times and patterns for anomalies that could suggest data extraction
• Review authentication logs for signs of unauthorized access following potential exploitation

How to Mitigate CVE-2024-3002

Immediate Actions Required

• Remove or restrict access to the Online Book System application until a patch is available
• Implement Web Application Firewall rules to block SQL injection attempts targeting /description.php
• Audit database logs for signs of past exploitation attempts
• Consider taking the application offline if it contains sensitive data and cannot be adequately protected

Patch Information

At the time of this writing, no official vendor patch has been released for this vulnerability. Organizations using the affected Online Book System 1.0 should contact the vendor for remediation guidance or consider alternative solutions. Monitor the VulDB advisory for updates on patch availability.

Workarounds

• Implement input validation on the ID parameter to accept only numeric values
• Deploy a Web Application Firewall (WAF) with SQL injection protection enabled
• Restrict network access to the application to trusted IP ranges only
• If source code access is available, modify the application to use parameterized queries or prepared statements

# Example WAF rule to block SQL injection patterns (ModSecurity)
SecRule ARGS:ID "@rx (?i)(union|select|insert|update|delete|drop|--|;|'|\")" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt blocked in ID parameter'"