CVE-2024-3466 Overview
CVE-2024-3466 is a SQL injection vulnerability in SourceCodester Laundry Management System 1.0, also distributed as the Oretnom23 Laundry Shop Management System. The flaw resides in the laporan_filter function inside /application/controller/Pengeluaran.php. Attackers manipulate the dari and sampai request arguments to inject arbitrary SQL statements into the underlying database query. The issue is tracked as VulDB entry VDB-259747 and maps to CWE-89. A public proof-of-concept is available, which lowers the barrier to exploitation.
Critical Impact
Authenticated attackers can inject arbitrary SQL through the dari and sampai parameters, exposing full database contents and enabling record modification.
Affected Products
- Oretnom23 Laundry Shop Management System 1.0
- SourceCodester Laundry Management System 1.0
- Component: /application/controller/Pengeluaran.php (laporan_filter function)
Discovery Timeline
- 2024-04-08 - CVE-2024-3466 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3466
Vulnerability Analysis
The vulnerability is a classic SQL injection (CWE-89) in the reporting workflow of the Laundry Shop Management System. The laporan_filter method in the Pengeluaran (expenses) controller accepts two date-range parameters, dari (from) and sampai (to), and concatenates them into a SQL query without parameterization or input sanitization. An attacker with low-privilege access to the application can submit crafted values that break out of the intended string context and append arbitrary SQL clauses.
Because the vulnerable endpoint sits behind authentication, exploitation requires valid application credentials. However, the application targets small business deployments where credential hygiene is often weak and default accounts are common. Successful exploitation compromises the confidentiality, integrity, and availability of the backend database.
Root Cause
The laporan_filter function builds its report query by directly interpolating user-supplied dari and sampai values into a raw SQL string. The CodeIgniter-based controller does not use parameter binding, prepared statements, or the framework's query builder escaping. Any character permitted in the HTTP request body, including quotes, comments, and UNION keywords, reaches the database engine unfiltered.
Attack Vector
Exploitation occurs over the network against the web application. An authenticated user issues a POST or GET request to the expense reporting endpoint with malicious payloads in the dari or sampai fields. Typical payloads use a UNION SELECT clause to exfiltrate credential hashes from user tables, or time-based blind techniques such as SLEEP() when responses are not directly reflected. The public proof-of-concept demonstrates the injection pattern; see the GitHub PoC for CVE-2024-3466 for the technical details.
Detection Methods for CVE-2024-3466
Indicators of Compromise
- HTTP requests to endpoints under /Pengeluaran containing SQL metacharacters such as single quotes, --, /*, or UNION in the dari or sampai parameters.
- Database error messages referencing Pengeluaran queries in application or web server logs.
- Anomalously long response times on expense-report endpoints, consistent with time-based blind SQL injection using SLEEP() or BENCHMARK().
- Unexpected outbound queries or large result sets originating from the application database user.
Detection Strategies
- Deploy web application firewall signatures for SQL injection patterns targeting the dari and sampai query parameters.
- Enable verbose query logging on the backing MySQL or MariaDB instance and alert on queries containing UNION SELECT, INFORMATION_SCHEMA, or stacked statements from the application account.
- Correlate authentication events with subsequent access to /application/controller/Pengeluaran.php to identify low-privilege accounts probing report functionality.
Monitoring Recommendations
- Forward web server, application, and database logs to a centralized analytics platform and retain them for a minimum of 90 days to support investigation.
- Baseline normal parameter values for dari and sampai (expected date formats) and alert on deviations.
- Monitor for spikes in HTTP 500 responses from the expense reporting endpoint, which often indicate injection probing.
How to Mitigate CVE-2024-3466
Immediate Actions Required
- Restrict network access to the Laundry Shop Management System to trusted networks or place it behind a VPN until the code is remediated.
- Disable or remove unused application accounts and rotate credentials for all remaining users.
- Deploy WAF rules that block SQL metacharacters in the dari and sampai parameters on the Pengeluaran controller.
- Review database and application logs for prior exploitation attempts using the indicators above.
Patch Information
No vendor patch has been published for CVE-2024-3466 at the time of writing. The affected product is a small-business PHP application distributed via SourceCodester and Oretnom23, and no vendor advisory is listed in NVD. Operators must apply source-level fixes: replace the vulnerable string concatenation in laporan_filter with CodeIgniter's query builder bindings or PDO prepared statements, and enforce strict server-side validation that dari and sampai match an expected date format such as YYYY-MM-DD. Refer to the VulDB entry for CVE-2024-3466 for tracking updates.
Workarounds
- Apply input validation at a reverse proxy layer to reject non-date values for dari and sampai parameters.
- Configure the application database user with the least privileges required, removing rights to INFORMATION_SCHEMA, FILE, and other sensitive objects.
- Restrict access to the /application/controller/Pengeluaran.php endpoint to administrative roles only via reverse proxy ACLs.
- If the application is not business-critical, take it offline until a source-level fix is implemented and validated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
