CVE-2024-3015: Simple Subscription Website SQL Injection

CVE-2024-3015 Overview

CVE-2024-3015 is a SQL injection vulnerability in SourceCodester Simple Subscription Website 1.0, developed by oretnom23. The flaw resides in the manage_plan.php file, where the id parameter is passed directly into a database query without proper sanitization [CWE-89].

Remote attackers with low-privilege access can manipulate the id argument to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database.

Critical Impact
Authenticated remote attackers can extract, modify, or destroy database contents by injecting SQL through the id parameter of manage_plan.php.

Affected Products

Oretnom23 Simple Subscription Website 1.0
manage_plan.php administrative component
Deployments referencing CPE cpe:2.3:a:oretnom23:simple_subscription_website:1.0

Discovery Timeline

2024-03-28 - CVE-2024-3015 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3015

Vulnerability Analysis

The vulnerability exists in the manage_plan.php script of Simple Subscription Website 1.0. The application accepts an id parameter through HTTP requests and incorporates it into a SQL query without applying input validation or parameterized queries.

An authenticated attacker with low privileges can supply crafted SQL payloads through the id argument. The database engine then executes the injected statements alongside the intended query. This grants the attacker the ability to read arbitrary tables, alter records, or execute administrative database operations.

Because the application is a subscription management platform, the exposed database likely contains subscriber credentials, plan details, and billing metadata. A public disclosure exists in a GitHub SQL Injection Report, and analysis is tracked in VulDB Entry #258301.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The manage_plan.php handler concatenates the user-supplied id value directly into a SQL statement. No prepared statements, parameter binding, or input filtering are applied before the query reaches the database driver.

Attack Vector

Exploitation is remote and network-based over standard HTTP. An attacker requires low-privilege access to the administrative area that exposes manage_plan.php. Once authenticated, the attacker issues a request such as manage_plan.php?id=<payload> containing SQL syntax like UNION SELECT or boolean-based blind injection payloads. No user interaction is required beyond the attacker's own session.

Exploitation pattern (conceptual):
GET /manage_plan.php?id=1 UNION SELECT username,password FROM users-- 
The injected clause executes within the original query context, returning
credential data from the users table. See the linked VulDB and GitHub
references for the published proof-of-concept details.

Detection Methods for CVE-2024-3015

Indicators of Compromise

HTTP requests to manage_plan.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, #, /*) in the id parameter.
Unexpected database errors or MySQL syntax messages logged after requests to manage_plan.php.
Anomalous outbound data volumes from the web server following administrative requests.

Detection Strategies

Enable web server access logging and alert on id parameter values that contain non-numeric characters or SQL metacharacters.
Deploy web application firewall (WAF) signatures targeting SQL injection patterns against the manage_plan.php endpoint.
Correlate database query logs with web requests to identify queries returning unusually large result sets or containing tautologies like 1=1.

Monitoring Recommendations

Monitor authentication logs for administrative account activity from unexpected source addresses that precede requests to manage_plan.php.
Track database user activity for schema enumeration attempts against information_schema tables.
Alert on repeated 500-series HTTP responses from the vulnerable script, which often indicate injection probing.

How to Mitigate CVE-2024-3015

Immediate Actions Required

Restrict network access to the administrative interface of Simple Subscription Website 1.0 using firewall rules or IP allowlisting.
Rotate all administrative credentials and audit user accounts within the application database.
Deploy a WAF rule that blocks SQL metacharacters in the id parameter of manage_plan.php.
Review database and web server logs for prior exploitation attempts referencing the disclosed proof of concept.

Patch Information

No official vendor patch is listed in the NVD advisory for Simple Subscription Website 1.0. Organizations running this application should consult the VulDB CVE Analysis #258301 for remediation guidance and consider migrating to an actively maintained subscription platform. Where source code access is available, replace direct string concatenation in manage_plan.php with prepared statements using PDO or MySQLi parameter binding.

Workarounds

Enforce strict server-side type validation on the id parameter, rejecting any value that is not a positive integer.
Apply least-privilege database credentials to the web application, limiting the impact of successful injection.
Place the application behind an authenticating reverse proxy to reduce exposure until code-level fixes are applied.

bash

# Example WAF-style ModSecurity rule to block non-numeric id values
SecRule ARGS:id "!@rx ^[0-9]+$" \
  "id:1002024301,phase:2,deny,status:403,\
  msg:'CVE-2024-3015 SQLi attempt on manage_plan.php',\
  logdata:'id=%{ARGS.id}'"