CVE-2024-3361 Overview
CVE-2024-3361 is a SQL injection vulnerability in SourceCodester Online Library System 1.0, developed by Janobe. The flaw resides in the admin/books/deweydecimal.php file, where the category parameter is passed to a database query without proper sanitization [CWE-89]. Attackers with low-privilege authenticated access can exploit the flaw remotely over the network. Public exploit details have been disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability was assigned identifier VDB-259465.
Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the category parameter, leading to full compromise of the backing database including read, modification, and deletion of records.
Affected Products
- Janobe Online Library System 1.0
- SourceCodester Online Library System 1.0
- Deployments exposing admin/books/deweydecimal.php
Discovery Timeline
- 2024-04-06 - CVE-2024-3361 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3361
Vulnerability Analysis
The vulnerability affects the Dewey Decimal category management functionality in the administrative interface of Online Library System 1.0. The admin/books/deweydecimal.php script accepts a category argument from HTTP request input and concatenates it directly into a SQL statement. Because no parameterized queries or input sanitization are applied, an attacker can supply crafted SQL syntax as part of the parameter value. The database engine then executes the injected statements with the privileges of the application's database user.
Exploitation requires network reachability to the affected endpoint and valid low-privilege credentials to the administrative area. The scope remains unchanged, but the confidentiality, integrity, and availability of the underlying database are fully impacted. The EPSS score of 0.83% places this vulnerability in the 53rd percentile of exploitation likelihood.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The category request parameter is embedded into the query string without prepared statements, parameter binding, or type validation. Any attacker who can reach deweydecimal.php and supply this parameter controls part of the SQL syntax executed by the database.
Attack Vector
The attack vector is remote over the network via crafted HTTP requests to admin/books/deweydecimal.php. An authenticated attacker submits a value for the category parameter containing SQL metacharacters such as single quotes, UNION SELECT clauses, or stacked queries. The injected SQL executes within the application's database session, exposing library records, user credentials, and potentially administrative data. Public disclosure of the exploit lowers the technical barrier for reuse.
See the GitHub Repository for Project and VulDB entry #259465 for technical details.
Detection Methods for CVE-2024-3361
Indicators of Compromise
- HTTP requests to admin/books/deweydecimal.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the category parameter
- Unusual database error responses returned from the Dewey Decimal endpoint
- Unexpected read or write activity against library tables originating from the web application's database account
Detection Strategies
- Deploy web application firewall rules that inspect requests to admin/books/deweydecimal.php for SQL injection payload patterns in the category parameter
- Enable database query logging and alert on queries containing tautologies, UNION operators, or comment sequences originating from the application account
- Correlate authentication logs with anomalous administrative activity to identify credential abuse preceding injection attempts
Monitoring Recommendations
- Monitor web server access logs for repeated 500-series responses tied to the Dewey Decimal endpoint
- Track outbound traffic volume from the database server for signs of bulk data exfiltration
- Alert on new administrative accounts or privilege changes within the Online Library System database
How to Mitigate CVE-2024-3361
Immediate Actions Required
- Restrict access to the /admin/ path using network ACLs, VPN, or IP allowlisting until a fix is deployed
- Rotate credentials for all administrative accounts and the application database user
- Review web server and database logs for prior exploitation attempts targeting deweydecimal.php
Patch Information
No vendor patch has been published for Janobe Online Library System 1.0 at the time of this writing. Organizations running the application should evaluate whether continued use is acceptable and apply compensating controls. Consult the VulDB CTI ID #259465 record for updates on remediation status.
Workarounds
- Modify the vulnerable source in admin/books/deweydecimal.php to use parameterized queries or PDO prepared statements for the category parameter
- Enforce strict server-side input validation to allow only expected characters for category values
- Place a web application firewall in front of the application with signatures for common SQL injection payloads
- Run the application database account with the minimum privileges required to reduce blast radius
# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/books/deweydecimal.php" \
"phase:2,chain,deny,status:403,id:1003361,msg:'CVE-2024-3361 SQLi attempt'"
SecRule ARGS:category "@detectSQLi" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
