CVE-2024-3797: QR Code Bookmark System SQLi Vulnerability

CVE-2024-3797 Overview

A critical SQL injection vulnerability has been discovered in SourceCodester QR Code Bookmark System version 1.0. The vulnerability exists in the /endpoint/delete-bookmark.php file, where the bookmark parameter is not properly sanitized before being used in database queries. This allows remote attackers to manipulate SQL queries by injecting malicious code through the vulnerable parameter, potentially leading to unauthorized database access, data theft, or complete system compromise.

Critical Impact
Remote unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the database, modify or delete records, and potentially achieve full system compromise through database server exploitation.

Affected Products

REMS QR Code Bookmark System 1.0
SourceCodester QR Code Bookmark System
Systems running vulnerable /endpoint/delete-bookmark.php endpoint

Discovery Timeline

2024-04-15 - CVE-2024-3797 published to NVD
2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-3797

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands. The vulnerable endpoint /endpoint/delete-bookmark.php accepts a bookmark parameter that is directly incorporated into SQL queries without adequate sanitization or parameterized queries. An attacker can craft malicious input to manipulate the intended SQL logic, enabling unauthorized database operations.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker can simply craft a malicious HTTP request targeting the vulnerable parameter to execute arbitrary SQL commands against the backend database.

Root Cause

The root cause of this vulnerability is the direct use of user-supplied input in SQL query construction without proper input validation, sanitization, or the use of prepared statements with parameterized queries. The bookmark parameter value is concatenated directly into the SQL query string, allowing injection of malicious SQL syntax.

Attack Vector

The attack vector is network-based, requiring no user interaction or authentication. An attacker can remotely send crafted HTTP requests to the /endpoint/delete-bookmark.php endpoint with a manipulated bookmark parameter. By injecting SQL metacharacters and commands into this parameter, an attacker can modify the query logic to extract data, bypass authentication, modify database contents, or potentially execute operating system commands depending on database configuration.

The vulnerable endpoint appears to be designed for bookmark deletion functionality, accepting a bookmark ID parameter. Instead of a simple numeric ID, an attacker can supply SQL injection payloads to manipulate the query behavior. For detailed technical analysis and exploitation methods, refer to the GitHub SQL Injection Exploit documentation and the VulDB entry #260764.

Detection Methods for CVE-2024-3797

Indicators of Compromise

Unusual database queries containing SQL syntax in application logs, particularly targeting the delete-bookmark.php endpoint
HTTP access logs showing requests to /endpoint/delete-bookmark.php with unexpected characters in the bookmark parameter (e.g., single quotes, UNION, SELECT, OR statements)
Database error messages or timeouts indicating injection attempts
Unexpected data extraction patterns or bulk database reads in database audit logs

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests to the QR Code Bookmark System
Enable database query logging and monitor for anomalous queries containing UNION, SELECT, or other injection indicators
Implement intrusion detection rules to alert on requests containing SQL metacharacters targeting /endpoint/delete-bookmark.php
Review web server access logs for suspicious parameter values in requests to the vulnerable endpoint

Monitoring Recommendations

Configure real-time alerting for SQL syntax appearing in HTTP request parameters to the bookmark management endpoints
Monitor database connection patterns for unusual activity that may indicate successful exploitation
Implement application-level logging to capture all requests to the delete-bookmark.php endpoint for forensic analysis
Set up automated scanning to detect the presence of vulnerable QR Code Bookmark System installations in your environment

How to Mitigate CVE-2024-3797

Immediate Actions Required

Immediately restrict access to the /endpoint/delete-bookmark.php endpoint through network controls or web server configuration
Deploy Web Application Firewall rules to filter SQL injection attempts targeting the vulnerable parameter
Consider taking the QR Code Bookmark System offline until a proper fix can be implemented
Review database logs for any evidence of prior exploitation and assess potential data exposure

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations using SourceCodester QR Code Bookmark System 1.0 should contact the vendor for remediation guidance or implement the workarounds described below. Monitor the VulDB entry for updates on patch availability.

Workarounds

Implement input validation on the bookmark parameter to ensure only numeric values are accepted
Modify the application code to use prepared statements with parameterized queries for all database operations
Restrict network access to the vulnerable endpoint using firewall rules or .htaccess configurations
Deploy a reverse proxy with SQL injection filtering capabilities in front of the application

bash

# Apache .htaccess example to restrict access to vulnerable endpoint
<Files "delete-bookmark.php">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
    # Allow from trusted_admin_ip_address
</Files>