CVE-2024-3442: Fast5 Prison Management System SQLi Flaw

CVE-2024-3442 Overview

CVE-2024-3442 is a SQL injection vulnerability in SourceCodester Prison Management System 1.0. The flaw resides in the /Employee/delete_leave.php script, where user-supplied input is passed to the backend database without proper sanitization. Attackers with low-privilege network access can manipulate SQL query parameters to read, modify, or destroy database contents. The exploit has been publicly disclosed and is tracked as VulDB entry VDB-259695. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL statements through delete_leave.php, compromising the confidentiality, integrity, and availability of the application database.

Affected Products

Fast5 Prison Management System 1.0
SourceCodester Prison Management System 1.0
Deployments using cpe:2.3:a:fast5:prison_management_system:1.0

Discovery Timeline

2024-04-08 - CVE-2024-3442 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3442

Vulnerability Analysis

The vulnerability resides in the delete_leave.php script under the /Employee/ directory. This script accepts a parameter used to identify the leave record targeted for deletion. The parameter is concatenated directly into a SQL statement executed against the backend database. Because the application performs no parameterization or input sanitization, an authenticated attacker can inject arbitrary SQL syntax into the query. Successful exploitation yields read and write access to database contents, including staff records, inmate records, and authentication data. The attacker interacts with the application over the network and needs only low-level privileges within the web interface.

The EPSS probability is 0.713% with a percentile of 50.6, indicating measurable exploitation interest given the public proof-of-concept disclosure through VulDB.

Root Cause

The root cause is the direct concatenation of untrusted HTTP request parameters into a SQL statement inside delete_leave.php. The code does not use prepared statements, parameter binding, or input validation before invoking the database driver. This classic [CWE-89] pattern allows attacker-controlled data to be interpreted as SQL syntax.

Attack Vector

An authenticated attacker submits a crafted HTTP request to /Employee/delete_leave.php with a malicious payload in the vulnerable parameter. The payload terminates the intended SQL query and appends attacker-controlled clauses such as UNION SELECT, OR 1=1, or stacked queries. The database engine executes the injected statements with the privileges of the application database user. See the public technical writeup on GitHub for parameter-level details.

Detection Methods for CVE-2024-3442

Indicators of Compromise

HTTP requests to /Employee/delete_leave.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ;.
Unexpected DELETE, UPDATE, or SELECT statements in database query logs originating from the application user.
Web server access logs showing repeated requests to delete_leave.php with varying parameter values from a single source.
Anomalous outbound data volumes from the database host following requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures that match SQL injection payload patterns against the /Employee/delete_leave.php endpoint.
Enable database query logging and alert on queries referencing the leave table that contain concatenated user input.
Correlate authenticated session activity with high-volume or malformed requests to leave-management endpoints.

Monitoring Recommendations

Monitor authentication and privilege changes on the underlying MySQL or MariaDB instance for signs of credential dumping.
Track error responses (HTTP 500 or database syntax errors) returned by delete_leave.php as an indicator of injection probing.
Baseline normal parameter values for the leave workflow and alert on deviations that include SQL operators.

How to Mitigate CVE-2024-3442

Immediate Actions Required

Restrict network access to the Prison Management System to trusted administrative networks until a fix is deployed.
Disable or remove the /Employee/delete_leave.php endpoint if the leave-management feature is not required.
Rotate database credentials and application session secrets if exploitation is suspected.
Review web and database logs for prior exploitation attempts targeting the vulnerable parameter.

Patch Information

No vendor patch has been published for Fast5 Prison Management System 1.0 at the time of NVD entry. Consult the VulDB advisory 259695 and the GitHub disclosure for the latest remediation status. Operators should replace vulnerable database calls in delete_leave.php with parameterized queries using PDO or MySQLi prepared statements.

Workarounds

Place a WAF in front of the application with rules that block SQL metacharacters on the affected parameter.
Apply least-privilege permissions to the database account used by the application, removing DDL and cross-table privileges.
Enforce strong authentication and session controls to limit which users can reach the /Employee/ endpoints.

bash

# Example ModSecurity rule to block SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /Employee/delete_leave.php" \
    "id:1003442,phase:2,deny,status:403,\
    msg:'Potential SQLi against Prison Management System (CVE-2024-3442)',\
    chain"
    SecRule ARGS "@detectSQLi" "t:none,t:urlDecodeUni"