CVE-2024-6215: Food Ordering Management System SQL Injection

CVE-2024-6215 Overview

CVE-2024-6215 is a SQL injection vulnerability affecting SourceCodester Food Ordering Management System version 1.0, developed by oretnom23. The flaw resides in the view-ticket-admin.php file, where the id parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is publicly disclosed and tracked as VulDB entry VDB-269279. It is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Attackers with low-privilege access can extract, modify, or delete database contents by injecting SQL through the id parameter of the administrative ticket view endpoint.

Affected Products

• Oretnom23 Food Ordering Management System 1.0
• SourceCodester distribution of Food Ordering Management System
• Deployments referenced by CPE cpe:2.3:a:oretnom23:food_ordering_management_system:1.0

Discovery Timeline

• 2024-06-21 - CVE-2024-6215 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6215

Vulnerability Analysis

The vulnerability exists in the view-ticket-admin.php script, which handles administrative ticket lookups. The script accepts an id request parameter and uses it to build a SQL query against the backend database. Because the input is concatenated directly into the query without parameterization or type validation, an attacker can append additional SQL syntax. Exploitation requires network access to the application and low-privilege authentication, but no user interaction. Successful injection allows the attacker to read arbitrary tables, including administrative credentials and customer order data, and potentially modify records depending on database user privileges. The EPSS probability is 0.532% (42.6 percentile), reflecting a publicly disclosed but not yet widely weaponized issue.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in view-ticket-admin.php. The id argument flows directly from the HTTP request into a raw SQL string, violating secure query construction practices defined in [CWE-89].

Attack Vector

The attack is delivered remotely over the network by sending a crafted HTTP request to the view-ticket-admin.php endpoint with a malicious id value. An authenticated session with administrator-level access to the ticket module is required to reach the vulnerable code path. Payloads typically use UNION-based or boolean-based blind injection to enumerate database schema and extract records.

Technical details and reproduction steps are published in the GitHub CVE Analysis and the VulDB Entry #269279.

Detection Methods for CVE-2024-6215

Indicators of Compromise

• HTTP requests to view-ticket-admin.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the id parameter.
• Web server access logs showing repeated requests to view-ticket-admin.php?id= with non-numeric or unusually long values.
• Database error messages referencing view-ticket-admin.php in application logs or PHP error output.
• Unexpected SELECT queries against users, admin, or credential tables originating from the web application account.

Detection Strategies

• Deploy web application firewall rules that flag SQL injection patterns targeting the id query string on administrative PHP endpoints.
• Enable MySQL general query logging or slow query logging and correlate anomalous queries with web access log entries.
• Alert on non-integer values submitted to the id parameter, which is expected to be numeric.

Monitoring Recommendations

• Monitor authenticated admin sessions for abnormal request volume against view-ticket-admin.php.
• Track database read volume from the web application service account and alert on spikes indicating enumeration.
• Forward web, application, and database logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2024-6215

Immediate Actions Required

• Restrict access to view-ticket-admin.php to trusted administrative IP ranges via web server ACLs.
• Rotate administrative credentials and database service account passwords used by the application.
• Audit the users and ticket-related tables for signs of unauthorized read or modification activity.
• Deploy a web application firewall signature blocking SQL metacharacters in the id parameter.

Patch Information

At the time of publication, no official vendor patch is listed in the NVD references for the Food Ordering Management System 1.0. Administrators should treat this codebase as end-of-support and plan migration. If continued use is required, apply source-level remediation by converting the query in view-ticket-admin.php to a parameterized prepared statement using PDO or mysqli with bound parameters, and enforce integer type casting on the id value.

Workarounds

• Take the administrative ticket view offline until source-level remediation is applied.
• Introduce a reverse proxy rule that rejects requests where id is not a positive integer.
• Apply database least-privilege by restricting the web application account to only the tables and operations required for normal function.
• Enable prepared statement enforcement or query allow-listing at the database proxy layer where available.

# Example nginx location rule enforcing numeric id parameter
location = /view-ticket-admin.php {
    if ($arg_id !~ ^[0-9]+$) { return 400; }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}