CVE-2024-3253: Internship Portal Management SQL Injection

CVE-2024-3253 Overview

CVE-2024-3253 is a SQL injection vulnerability in SourceCodester Internship Portal Management System 1.0. The flaw resides in admin/add_admin.php, where the name, username, and password parameters are passed to database queries without proper sanitization. Authenticated attackers can manipulate these arguments to inject arbitrary SQL statements over the network. The issue is tracked as VulDB entry 259102 and mapped to CWE-89. Public disclosure of the exploit details has occurred, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Successful exploitation permits arbitrary SQL execution against the backend database, enabling data theft, tampering, or complete compromise of administrative records in the portal.

Affected Products

SourceCodester Internship Portal Management System 1.0
Chatikobo Internship Portal Management System 1.0
admin/add_admin.php endpoint in the above builds

Discovery Timeline

2024-04-03 - CVE-2024-3253 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3253

Vulnerability Analysis

The vulnerability exists in the administrative account creation workflow of the Internship Portal Management System. When an authenticated administrator submits the add-admin form, the admin/add_admin.php script accepts the name, username, and password fields directly from the HTTP request. These values are concatenated into a SQL INSERT statement without prepared statements or input sanitization. An attacker holding valid admin credentials, or one who has obtained them through phishing or credential reuse, can inject SQL syntax through any of the three fields. The database engine then executes attacker-controlled statements alongside the intended insert operation. The attack complexity is low and requires no user interaction beyond the attacker's own request submission.

Root Cause

The root cause is missing parameterization of user-supplied input in the add_admin.php handler, classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The application trusts POST parameters and interpolates them into query strings, violating the principle of separating code from data.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS against the administrative interface. The attacker sends a crafted POST request to admin/add_admin.php with malicious payloads embedded in the name, username, or password fields. High privileges are required because the endpoint sits behind the admin login, but once accessed the injection yields full read, write, and modify capabilities against the underlying database. See the public proof-of-concept for payload structure and reproduction steps.

No verified exploit code is republished here. Refer to the VulDB record for additional technical context.

Detection Methods for CVE-2024-3253

Indicators of Compromise

Unexpected new rows in the admin or equivalent users table with anomalous name or username values containing quotes, comments, or SQL keywords.
Web server access logs showing POST requests to admin/add_admin.php containing characters such as ', --, #, UNION, SELECT, or SLEEP(.
Database error messages surfaced in application logs referencing syntax errors from the add_admin code path.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST bodies to admin/add_admin.php for SQL metacharacters and known injection patterns.
Enable database query logging and alert on statements originating from the portal that include UNION, stacked queries, or time-based functions.
Correlate authentication events with subsequent add-admin actions to identify sessions performing anomalous administrative activity.

Monitoring Recommendations

Monitor for creation of new administrative accounts outside of change-control windows.
Track outbound database traffic volumes from the application host for signs of bulk data exfiltration following admin form submissions.
Baseline normal admin form request sizes and alert on payloads that significantly exceed the baseline.

How to Mitigate CVE-2024-3253

Immediate Actions Required

Restrict network access to the admin/ directory using IP allow-lists or VPN gating until a fix is deployed.
Rotate all administrator credentials and audit the admin user table for unauthorized entries.
Review web and database logs for prior exploitation attempts against admin/add_admin.php.

Patch Information

No official vendor patch has been published for SourceCodester Internship Portal Management System 1.0 at the time of writing. Operators should treat the application as end-of-support and consider migrating to a maintained platform, or apply the source-level fixes described below.

Workarounds

Rewrite the affected queries in admin/add_admin.php to use PDO or mysqli prepared statements with bound parameters for name, username, and password.
Apply server-side input validation that rejects SQL metacharacters in administrative form fields.
Enforce least-privilege database accounts so the web application cannot execute DDL or access unrelated schemas.
Place the application behind a WAF configured with OWASP Core Rule Set SQL injection signatures.

bash

# Example prepared-statement remediation pattern (PHP/mysqli)
$stmt = $conn->prepare("INSERT INTO admin (name, username, password) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $name, $username, $hashedPassword);
$stmt->execute();