CVE-2024-3256: Internship Portal Management SQLI Flaw

CVE-2024-3256 Overview

CVE-2024-3256 is a SQL injection vulnerability in SourceCodester Internship Portal Management System 1.0. The flaw resides in the admin/edit_activity.php script, where the activity_id parameter is passed directly into a SQL query without proper sanitization. An authenticated attacker can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, and the issue is tracked under VulDB identifier VDB-259105. The vulnerability is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote SQL injection through activity_id allows attackers with administrative access to read, modify, or delete arbitrary database records in the Internship Portal Management System.

Affected Products

Chatikobo Internship Portal Management System 1.0
SourceCodester Internship Portal Management System 1.0
admin/edit_activity.php endpoint

Discovery Timeline

2024-04-03 - CVE-2024-3256 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3256

Vulnerability Analysis

The vulnerability exists in the administrative editing workflow of the Internship Portal Management System. The admin/edit_activity.php script accepts the activity_id parameter over HTTP and incorporates it into a SQL statement without parameterized queries or input validation. Attackers can append SQL operators and subqueries to activity_id to alter the intended query logic.

Exploitation requires network access to the application and valid administrative credentials, as the affected file resides in the admin directory. Successful attacks can extract sensitive records, modify activity data, or escalate impact through database-level functions such as LOAD_FILE or INTO OUTFILE depending on database privileges.

Root Cause

The root cause is improper neutralization of user-controlled input in a SQL query. The application concatenates the activity_id parameter into the query string rather than binding it as a prepared statement parameter. This design pattern allows attacker-supplied SQL syntax to be executed by the backend database engine.

Attack Vector

The attack vector is remote over HTTP. An authenticated administrator or an attacker who has obtained administrator credentials sends a crafted request to admin/edit_activity.php with a malicious activity_id value. Typical payloads use UNION-based, boolean-based, or time-based blind injection patterns to enumerate the database schema and exfiltrate data. Public proof-of-concept material is referenced in the GitHub Project Repository and the VulDB entry #259105.

Detection Methods for CVE-2024-3256

Indicators of Compromise

HTTP requests to admin/edit_activity.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences like -- and # in the activity_id parameter.
Unusually long or URL-encoded values submitted for activity_id, particularly containing single quotes, parentheses, or hexadecimal payloads.
Database error messages returned to clients or logged by PHP referencing malformed SQL syntax related to the activities table.
Unexpected outbound queries or spikes in database CPU tied to the admin session executing edits.

Detection Strategies

Deploy a web application firewall rule that inspects the activity_id parameter for SQL metacharacters and blocks non-numeric input.
Enable SQL query logging on the backend database and alert on statements originating from edit_activity.php that deviate from the expected parameterized template.
Correlate authentication logs with sudden schema enumeration queries (information_schema.tables, information_schema.columns) from the application service account.

Monitoring Recommendations

Monitor administrative session activity for anomalous request rates against admin/edit_activity.php.
Track failed and successful admin logins followed by high-volume database read operations.
Retain HTTP access logs with full query strings for at least 90 days to support forensic review.

How to Mitigate CVE-2024-3256

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlists or VPN-only access until a fix is applied.
Rotate all administrator credentials and audit accounts with elevated privileges in the portal.
Review database logs for signs of prior exploitation, focusing on queries touching the activities table.
Apply the principle of least privilege to the database user backing the application, removing FILE, CREATE, and DROP privileges where possible.

Patch Information

No official vendor patch has been published for the Chatikobo Internship Portal Management System 1.0 at the time of CVE assignment. Consult the VulDB CTI entry #259105 and the VulDB submission #309217 for status updates. Organizations should evaluate whether continued operation of this application is appropriate given the absence of a supported fix.

Workarounds

Modify admin/edit_activity.php to cast activity_id to an integer using intval() before use in any SQL statement.
Refactor the affected query to use PDO prepared statements or mysqli parameterized queries with bound parameters.
Deploy a WAF signature that rejects requests to edit_activity.php where activity_id is not a positive integer.
Enforce multi-factor authentication for administrator accounts to raise the barrier for exploitation.

bash

# Example WAF rule (ModSecurity) to enforce numeric activity_id
SecRule ARGS:activity_id "!@rx ^[0-9]+$" \
    "id:1002456,\
    phase:2,\
    deny,\
    status:400,\
    msg:'CVE-2024-3256: Non-numeric activity_id blocked',\
    tag:'cwe-89',\
    tag:'sql-injection'"