CVE-2024-3255: Internship Portal Management System SQLi

CVE-2024-3255 Overview

CVE-2024-3255 is a SQL injection vulnerability in SourceCodester Internship Portal Management System 1.0. The flaw resides in the admin/edit_admin_query.php file, where the username, password, name, and admin_id parameters are passed to the database without proper sanitization. An authenticated attacker can manipulate these arguments to inject arbitrary SQL statements. The issue is tracked as VulDB entry VDB-259104 and maps to [CWE-89]. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL statements against the backend database, leading to full compromise of confidentiality, integrity, and availability of stored records.

Affected Products

Chatikobo Internship Portal Management System 1.0
Component: admin/edit_admin_query.php
CPE: cpe:2.3:a:chatikobo:internship_portal_management_system:1.0

Discovery Timeline

2024-04-03 - CVE-2024-3255 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3255

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw located in admin/edit_admin_query.php. This administrative endpoint accepts the username, password, name, and admin_id parameters and concatenates them into SQL statements without parameterization or input validation. Attackers with administrative access can modify these parameters to alter query logic, extract database contents, or manipulate stored records. Because the affected endpoint is administrative, exploitation requires elevated privileges, but any compromised admin session enables full database takeover. The EPSS probability of 0.758% places this vulnerability in the 52nd percentile for likelihood of exploitation.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. User-supplied input from HTTP request parameters is embedded directly into SQL queries without prepared statements or escaping routines. This design pattern allows attacker-controlled input to break out of the intended query context and inject additional SQL clauses.

Attack Vector

Exploitation occurs over the network against the administrative interface of the application. An attacker submits crafted values in the username, password, name, or admin_id parameters through a POST or GET request to admin/edit_admin_query.php. The injected payload is executed by the backend MySQL database with the privileges of the application database user. Public proof-of-concept material is available at the GitHub Repository for Internship Portal.

No verified exploit code is available for inclusion. See the VulDB CVE Analysis #259104 for additional technical details on the injection points.

Detection Methods for CVE-2024-3255

Indicators of Compromise

Web server access logs containing SQL metacharacters (single quotes, UNION, SELECT, --, ;) in requests to admin/edit_admin_query.php
Unexpected changes to the admin or user tables, including new administrative accounts or modified credentials
Database error messages returned to clients through the administrative interface

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET parameters submitted to edit_admin_query.php for SQL injection signatures
Enable MySQL general query logging and alert on queries containing tautologies such as OR 1=1 or stacked statements originating from the application user
Correlate authentication events with suspicious query patterns to identify compromised administrative sessions

Monitoring Recommendations

Monitor outbound connections from the database host for signs of data exfiltration following administrative activity
Track file integrity on the admin/ directory to detect webshell drops that often follow successful SQL injection
Review admin account creation and privilege change events on a daily cadence

How to Mitigate CVE-2024-3255

Immediate Actions Required

Restrict access to the admin/ directory using network-level controls or IP allowlisting until a vendor patch is available
Rotate all administrative credentials and audit the admin table for unauthorized accounts
Deploy a WAF with SQL injection rulesets in front of the application

Patch Information

No vendor patch has been published for Chatikobo Internship Portal Management System 1.0 at the time of writing. Organizations running this application should treat it as end-of-support and plan migration to a maintained alternative. Consult the VulDB #259104 entry for updates on remediation status.

Workarounds

Rewrite admin/edit_admin_query.php to use parameterized queries or prepared statements via mysqli_prepare() or PDO with bound parameters
Enforce strict input validation and type-casting on admin_id (integer) and other parameters before database interaction
Apply least-privilege principles to the application database account, removing DROP, ALTER, and FILE privileges where not required

bash

# Example WAF ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/edit_admin_query.php" \
    "id:1002451,phase:2,deny,status:403,\
    chain,msg:'Potential SQLi on edit_admin_query.php'"
    SecRule ARGS:username|ARGS:password|ARGS:name|ARGS:admin_id \
        "@detectSQLi" "t:none,t:urlDecodeUni"