CVE-2024-6419: Medicine Tracker System SQLi Vulnerability

CVE-2024-6419 Overview

CVE-2024-6419 is a SQL injection vulnerability in SourceCodester Medicine Tracker System 1.0 developed by oretnom23. The flaw resides in /classes/Master.php?f=save_medicine, where the id parameter is incorporated into a SQL query without proper sanitization. Attackers can manipulate this parameter remotely to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability is tracked in VulDB as identifier 270010 and is classified under CWE-89.

Critical Impact

Remote authenticated attackers can manipulate the id parameter to execute arbitrary SQL queries against the backend database, exposing or modifying medicine records and related data.

Affected Products

• SourceCodester Medicine Tracker System 1.0
• oretnom23 medicine_tracker_system 1.0
• Deployments using the vulnerable /classes/Master.php?f=save_medicine endpoint

Discovery Timeline

• 2024-07-01 - CVE-2024-6419 published to the National Vulnerability Database
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6419

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the save_medicine function handler within /classes/Master.php. The application accepts the id argument from user-controlled input and concatenates it directly into a SQL statement used to insert or update medicine records. Because the value is not parameterized or sanitized, attackers can break out of the intended query context and append additional SQL syntax. The flaw is network-accessible and does not require user interaction. Public disclosure of exploitation details lowers the technical barrier for attackers targeting affected installations.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command, classified under [CWE-89]. The Master.php script handles the save_medicine action by trusting the supplied id parameter without input validation or prepared statements. Direct string concatenation into the SQL query enables injection of arbitrary clauses, including UNION-based extraction or boolean-based blind techniques.

Attack Vector

An attacker sends a crafted HTTP POST request to /classes/Master.php?f=save_medicine containing a malicious payload in the id parameter. The injected SQL executes with the privileges of the database user configured for the application. Depending on the database account permissions, an attacker can read sensitive medical records, modify or delete data, or extract authentication credentials from related tables. Refer to the GitHub SQLi Analysis and VulDB Technical Advisory for additional context.

Detection Methods for CVE-2024-6419

Indicators of Compromise

• HTTP requests targeting /classes/Master.php?f=save_medicine containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id parameter
• Unexpected database errors or anomalous query patterns logged by the MySQL/MariaDB backend
• Outbound connections or data exfiltration originating from the web server process following suspicious requests

Detection Strategies

• Deploy web application firewall rules that inspect POST bodies submitted to Master.php for SQL injection signatures
• Enable verbose database query logging and alert on parameterized values containing SQL syntax tokens
• Correlate web server access logs with database audit logs to identify requests producing abnormal query structures

Monitoring Recommendations

• Monitor the /classes/Master.php endpoint for unusual request rates, oversized payloads, or repeated 500-level responses
• Track changes to the medicine and user tables for unauthorized inserts, updates, or schema modifications
• Alert on database authentication failures and privilege changes that may follow successful injection

How to Mitigate CVE-2024-6419

Immediate Actions Required

• Restrict network access to the Medicine Tracker System using firewall rules or VPN-only access until a patch is applied
• Audit existing database accounts used by the application and reduce privileges to the minimum required
• Review web server and database logs for prior exploitation attempts against the save_medicine endpoint

Patch Information

No official vendor patch has been published at the time of writing. SourceCodester Medicine Tracker System 1.0 remains vulnerable. Administrators should track the VulDB advisory for vendor updates and consider replacing the application with a maintained alternative if no fix becomes available.

Workarounds

• Modify /classes/Master.php to use prepared statements with bound parameters for the id value in the save_medicine handler
• Apply server-side input validation to enforce numeric-only values where appropriate before passing data to SQL queries
• Deploy a web application firewall with SQL injection signatures in front of the application as a compensating control

# Configuration example
# Example ModSecurity rule blocking SQLi attempts on the affected endpoint
SecRule REQUEST_URI "@contains /classes/Master.php" \
  "id:1006419,phase:2,deny,status:403,\
   chain,msg:'CVE-2024-6419 SQLi attempt on save_medicine'"
  SecRule ARGS:id "@detectSQLi" "t:none"