CVE-2024-3797: QR Code Bookmark System SQLi Vulnerability

CVE-2024-3797 Overview

A critical SQL injection vulnerability has been discovered in SourceCodester QR Code Bookmark System version 1.0. The vulnerability exists in the /endpoint/delete-bookmark.php file, where the bookmark parameter is not properly sanitized before being used in database queries. This allows remote attackers to manipulate SQL queries by injecting malicious code through the vulnerable parameter, potentially leading to unauthorized database access, data theft, or complete system compromise.

Critical Impact

Remote unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the database, modify or delete records, and potentially achieve full system compromise through database server exploitation.

Affected Products

• REMS QR Code Bookmark System 1.0
• SourceCodester QR Code Bookmark System
• Systems running vulnerable /endpoint/delete-bookmark.php endpoint

Discovery Timeline

• 2024-04-15 - CVE-2024-3797 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-3797

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands. The vulnerable endpoint /endpoint/delete-bookmark.php accepts a bookmark parameter that is directly incorporated into SQL queries without adequate sanitization or parameterized queries. An attacker can craft malicious input to manipulate the intended SQL logic, enabling unauthorized database operations.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker can simply craft a malicious HTTP request targeting the vulnerable parameter to execute arbitrary SQL commands against the backend database.

Root Cause

The root cause of this vulnerability is the direct use of user-supplied input in SQL query construction without proper input validation, sanitization, or the use of prepared statements with parameterized queries. The bookmark parameter value is concatenated directly into the SQL query string, allowing injection of malicious SQL syntax.

Attack Vector

The attack vector is network-based, requiring no user interaction or authentication. An attacker can remotely send crafted HTTP requests to the /endpoint/delete-bookmark.php endpoint with a manipulated bookmark parameter. By injecting SQL metacharacters and commands into this parameter, an attacker can modify the query logic to extract data, bypass authentication, modify database contents, or potentially execute operating system commands depending on database configuration.

The vulnerable endpoint appears to be designed for bookmark deletion functionality, accepting a bookmark ID parameter. Instead of a simple numeric ID, an attacker can supply SQL injection payloads to manipulate the query behavior. For detailed technical analysis and exploitation methods, refer to the GitHub SQL Injection Exploit documentation and the VulDB entry #260764.

Detection Methods for CVE-2024-3797

Indicators of Compromise

• Unusual database queries containing SQL syntax in application logs, particularly targeting the delete-bookmark.php endpoint
• HTTP access logs showing requests to /endpoint/delete-bookmark.php with unexpected characters in the bookmark parameter (e.g., single quotes, UNION, SELECT, OR statements)
• Database error messages or timeouts indicating injection attempts
• Unexpected data extraction patterns or bulk database reads in database audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests to the QR Code Bookmark System
• Enable database query logging and monitor for anomalous queries containing UNION, SELECT, or other injection indicators
• Implement intrusion detection rules to alert on requests containing SQL metacharacters targeting /endpoint/delete-bookmark.php
• Review web server access logs for suspicious parameter values in requests to the vulnerable endpoint

Monitoring Recommendations

• Configure real-time alerting for SQL syntax appearing in HTTP request parameters to the bookmark management endpoints
• Monitor database connection patterns for unusual activity that may indicate successful exploitation
• Implement application-level logging to capture all requests to the delete-bookmark.php endpoint for forensic analysis
• Set up automated scanning to detect the presence of vulnerable QR Code Bookmark System installations in your environment

How to Mitigate CVE-2024-3797

Immediate Actions Required

• Immediately restrict access to the /endpoint/delete-bookmark.php endpoint through network controls or web server configuration
• Deploy Web Application Firewall rules to filter SQL injection attempts targeting the vulnerable parameter
• Consider taking the QR Code Bookmark System offline until a proper fix can be implemented
• Review database logs for any evidence of prior exploitation and assess potential data exposure

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations using SourceCodester QR Code Bookmark System 1.0 should contact the vendor for remediation guidance or implement the workarounds described below. Monitor the VulDB entry for updates on patch availability.

Workarounds

• Implement input validation on the bookmark parameter to ensure only numeric values are accepted
• Modify the application code to use prepared statements with parameterized queries for all database operations
• Restrict network access to the vulnerable endpoint using firewall rules or .htaccess configurations
• Deploy a reverse proxy with SQL injection filtering capabilities in front of the application

# Apache .htaccess example to restrict access to vulnerable endpoint
<Files "delete-bookmark.php">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
    # Allow from trusted_admin_ip_address
</Files>