CVE-2024-5134: Electricity Monitoring Tool SQLi Vulnerability

CVE-2024-5134 Overview

CVE-2024-5134 is a SQL injection vulnerability in SourceCodester Electricity Consumption Monitoring Tool 1.0. The flaw resides in /endpoint/delete-bill.php, where the bill parameter is passed to a database query without proper sanitization. Remote attackers with low privileges can manipulate this argument to inject arbitrary SQL statements. The vulnerability is tracked under VulDB identifier VDB-265210 and classified as [CWE-89]. Public disclosure includes a working exploit, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact

Remote authenticated attackers can manipulate the bill parameter in delete-bill.php to execute arbitrary SQL queries, leading to data disclosure, modification, or deletion within the application database.

Affected Products

• SourceCodester Electricity Consumption Monitoring Tool 1.0
• Remyandrade Electricity Consumption Monitoring Tool (CPE: cpe:2.3:a:remyandrade:electricity_consumption_monitoring_tool:1.0)
• File-specific impact: /endpoint/delete-bill.php

Discovery Timeline

• 2024-05-20 - CVE-2024-5134 published to NVD
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2024-5134

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The affected endpoint /endpoint/delete-bill.php accepts a user-controlled bill parameter and concatenates it directly into a SQL DELETE statement. Because the application does not use parameterized queries or input validation, attackers can break out of the intended query context. The exploit has been disclosed publicly, with technical details available in the GitHub SQL Injection writeup and the VulDB advisory.

Root Cause

The root cause is direct concatenation of unsanitized user input into a SQL statement within delete-bill.php. The application relies on client-supplied values for the bill argument without enforcing a numeric type check, escaping, or prepared statements. This allows the SQL parser to treat injected payloads as executable query syntax rather than data.

Attack Vector

The attack is initiated remotely over the network and requires low-level authenticated access to reach the vulnerable endpoint. An attacker submits a crafted request containing SQL metacharacters in the bill parameter to /endpoint/delete-bill.php. Successful injection enables enumeration of database contents through UNION-based or time-based blind techniques, modification of billing records, or destructive operations such as dropping tables. The vulnerability impacts confidentiality, integrity, and availability of the underlying database.

No verified proof-of-concept code is included here. Refer to the public disclosure for technical exploitation details.

Detection Methods for CVE-2024-5134

Indicators of Compromise

• HTTP requests to /endpoint/delete-bill.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the bill parameter.
• Web server access logs showing abnormally long or encoded values for the bill query string.
• Unexpected database errors, latency spikes, or unauthorized deletions in billing tables.

Detection Strategies

• Inspect web application firewall (WAF) logs for SQL injection signatures targeting the bill parameter on the vulnerable endpoint.
• Enable database query logging and alert on DELETE or UNION statements originating from the application service account that deviate from normal patterns.
• Conduct static code review or dynamic scanning (DAST) against /endpoint/delete-bill.php to confirm presence of the unsanitized parameter.

Monitoring Recommendations

• Monitor outbound network connections from the web application host that may indicate post-exploitation data exfiltration.
• Track authentication events preceding requests to delete-bill.php to correlate compromised low-privilege accounts with injection attempts.
• Aggregate web, database, and host telemetry in a centralized analytics platform to detect multi-stage injection chains.

How to Mitigate CVE-2024-5134

Immediate Actions Required

• Restrict network access to the Electricity Consumption Monitoring Tool, exposing it only to trusted internal networks or behind a VPN.
• Deploy WAF rules that block SQL injection payloads targeting the bill parameter and other endpoints in /endpoint/.
• Audit existing billing records and database logs for evidence of prior exploitation.
• Rotate any database credentials that may have been exposed through prior injection attempts.

Patch Information

No official vendor patch is listed in the public advisories for this issue. Organizations running SourceCodester Electricity Consumption Monitoring Tool 1.0 should consider discontinuing use or applying source-level fixes by replacing concatenated SQL with prepared statements using PDO or MySQLi parameter binding. Validate the bill parameter as a strict integer before any database interaction.

Workarounds

• Modify delete-bill.php to cast the bill parameter to an integer using intval() or equivalent type enforcement before query execution.
• Implement parameterized queries with PDO prepare() and bindParam() to eliminate string concatenation in SQL statements.
• Apply least-privilege database accounts so the web application cannot execute DROP, ALTER, or cross-schema queries.
• Disable or remove the vulnerable endpoint if billing deletion is not required in production deployments.

# Example WAF rule pattern (ModSecurity)
SecRule ARGS:bill "@rx (?i)(union(.*?)select|sleep\(|--|';|/\*)" \
    "id:1005134,phase:2,deny,status:403,msg:'CVE-2024-5134 SQLi attempt on bill parameter'"