CVE-2024-3259: Internship Portal Management System SQLi

CVE-2024-3259 Overview

CVE-2024-3259 is a SQL injection vulnerability in SourceCodester Internship Portal Management System 1.0. The flaw resides in admin/delete_activity.php, where the activity_id parameter is passed directly into a SQL query without proper sanitization. Authenticated attackers with administrative privileges can manipulate the parameter to execute arbitrary SQL statements against the backend database. The issue is tracked as VulDB entry VDB-259108 and is classified under [CWE-89]. The exploit has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact

Remote SQL injection through the activity_id parameter allows attackers to read, modify, or destroy database contents on affected Internship Portal Management System deployments.

Affected Products

• SourceCodester Internship Portal Management System 1.0
• Chatikobo Internship Portal Management System 1.0
• admin/delete_activity.php endpoint

Discovery Timeline

• 2024-04-03 - CVE-2024-3259 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3259

Vulnerability Analysis

The vulnerability affects the administrative activity deletion workflow in Internship Portal Management System 1.0. The admin/delete_activity.php script accepts an activity_id parameter from HTTP requests and concatenates it into a SQL DELETE statement. Because the input is neither validated nor bound as a parameter, attackers can inject arbitrary SQL syntax. Successful exploitation compromises confidentiality, integrity, and availability of the underlying database.

The attack requires network access to the admin panel and valid administrator authentication. Attack complexity is low and no user interaction is required. Public disclosure through VulDB and a GitHub proof-of-concept lowers the barrier to exploitation. The EPSS score is 0.758% with a percentile of 51.4.

Root Cause

The root cause is missing input validation and the absence of parameterized queries in admin/delete_activity.php. The activity_id value from the request is directly interpolated into a raw SQL statement, allowing an attacker to break out of the intended query context and append additional SQL clauses.

Attack Vector

An authenticated administrator sends a crafted HTTP request to admin/delete_activity.php with a malicious activity_id value. Injected payloads such as UNION SELECT clauses, stacked queries, or time-based blind primitives can be used to extract sensitive data, escalate application privileges, or corrupt records. Refer to the GitHub proof-of-concept and the VulDB entry #259108 for technical details.

Detection Methods for CVE-2024-3259

Indicators of Compromise

• Requests to admin/delete_activity.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, --, or ; in the activity_id parameter.
• Unexpected database errors or 500 responses originating from the delete activity endpoint in web server logs.
• Anomalous DELETE, SELECT, or INFORMATION_SCHEMA queries generated by the application database user.

Detection Strategies

• Deploy web application firewall rules that inspect the activity_id parameter for SQL syntax and known injection patterns.
• Enable verbose SQL query logging on the database server and alert on syntactically unusual DELETE statements referencing the activities table.
• Correlate web access logs with database logs to identify requests that trigger multi-statement or time-delayed queries.

Monitoring Recommendations

• Monitor administrator authentication events for brute-force attempts or credential reuse targeting the admin portal.
• Track outbound data volume from the database host to identify potential data exfiltration following injection attempts.
• Alert on file access or modification within admin/ PHP scripts that could indicate post-exploitation web shell deployment.

How to Mitigate CVE-2024-3259

Immediate Actions Required

• Restrict network access to the administrative interface using IP allowlisting or VPN-only access.
• Rotate administrator credentials and audit the admin user table for unauthorized accounts.
• Review database contents in the activities and users tables for evidence of tampering or unauthorized reads.

Patch Information

No official vendor patch is listed in the referenced advisories for Internship Portal Management System 1.0. Operators should replace the vulnerable query in admin/delete_activity.php with prepared statements using PDO or MySQLi parameter binding, and cast activity_id to an integer before use. Consult the VulDB advisory #259108 for tracking updates.

Workarounds

• Apply a WAF signature that blocks non-numeric values in the activity_id parameter for admin/delete_activity.php.
• Enforce the principle of least privilege on the database account used by the application, removing DROP and administrative rights.
• Consider taking the application offline until code-level remediation with parameterized queries is deployed.

# Example WAF rule (ModSecurity) to block non-numeric activity_id
SecRule ARGS:activity_id "!@rx ^[0-9]+$" \
    "id:1002024,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2024-3259: Non-numeric activity_id blocked'"