CVE-2024-3222: PHP Task Management System SQL Injection Flaw

CVE-2024-3222 Overview

CVE-2024-3222 is a SQL injection vulnerability in SourceCodester PHP Task Management System 1.0, developed by Mayurik. The flaw resides in the admin-password-change.php file, where the admin_id parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks. The vulnerability is tracked under VulDB identifier VDB-259067 and is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Successful exploitation allows attackers to read, modify, or delete arbitrary database records, including administrator credentials, leading to full application compromise.

Affected Products

Mayurik PHP Task Management System 1.0
Component: admin-password-change.php
Vulnerable parameter: admin_id

Discovery Timeline

2024-04-03 - CVE-2024-3222 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3222

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the administrator password change workflow. The admin-password-change.php script accepts an admin_id argument from the client and incorporates it directly into a SQL statement. Because the parameter is not validated, escaped, or bound as a prepared statement placeholder, an attacker can append arbitrary SQL syntax.

Exploitation requires network access and low-privileged authentication to the application. Once injected, the attacker can enumerate the database schema, extract stored credentials, or overwrite the administrator password. This compromises the integrity, confidentiality, and availability of the underlying data.

Root Cause

The root cause is the direct concatenation of untrusted input into a SQL query executed against the backend database. The application lacks parameterized queries and input filtering on the admin_id argument in admin-password-change.php. This violates secure coding practices for database interactions in PHP applications.

Attack Vector

An attacker sends a crafted HTTP request to admin-password-change.php containing a malicious payload in the admin_id parameter. The payload closes the original query context and injects attacker-controlled SQL. Since a public proof of concept has been disclosed via VulDB and GitHub, automated scanners and opportunistic actors can leverage the exploit against exposed instances.

The vulnerability mechanism is documented in the VulDB advisory #259067 and the GitHub CVE report. No verified exploit code is reproduced here.

Detection Methods for CVE-2024-3222

Indicators of Compromise

HTTP requests to admin-password-change.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the admin_id parameter.
Unexpected changes to administrator account records or password hashes in the application database.
Database error messages returned in HTTP responses referencing SQL syntax or table names.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests targeting admin-password-change.php for SQL injection signatures.
Enable verbose database query logging and alert on queries containing tautologies such as OR 1=1 or stacked statements.
Correlate authentication events with subsequent admin password modifications to detect anomalous privilege escalation.

Monitoring Recommendations

Monitor web server access logs for repeated requests to admin endpoints from a single source IP.
Track outbound database connections and query volumes for spikes indicative of automated exploitation.
Review administrator account activity for logins from unusual geographies or user agents following exploit attempts.

How to Mitigate CVE-2024-3222

Immediate Actions Required

Restrict access to the PHP Task Management System administrative interface using IP allowlisting or a VPN.
Audit the application database for unauthorized changes to administrator accounts and rotate all admin credentials.
Remove the vulnerable application from internet-facing infrastructure until a patched build is available.

Patch Information

No official vendor patch has been published for Mayurik PHP Task Management System 1.0 at the time of NVD publication. Organizations should track the VulDB entry for updates and consider migrating to an alternative task management platform if a fix is not released.

Workarounds

Modify admin-password-change.php to use PDO or mysqli prepared statements with bound parameters for the admin_id value.
Enforce server-side type validation to ensure admin_id contains only expected numeric characters before use in any query.
Deploy a WAF with SQL injection signatures in front of the application to block malicious payloads at the network edge.

bash

# Example: WAF rule concept for ModSecurity blocking SQLi on admin_id
# SecRule ARGS:admin_id "@detectSQLi" \
#   "id:1002024,phase:2,deny,status:403,msg:'SQLi attempt on admin_id'"