CVE-2024-6440: Home Owners Collection Management SQLi Flaw

CVE-2024-6440 Overview

CVE-2024-6440 is a SQL injection vulnerability affecting SourceCodester Home Owners Collection Management System 1.0. The flaw resides in the delete_category function exposed through /classes/Master.php?f=delete_category. Attackers can manipulate the id parameter to inject arbitrary SQL statements into the backend database query. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is tracked as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The vulnerability is also referenced as VDB-270168 in the Vulnerability Database.

Critical Impact

Remote attackers with low-privileged accounts can execute arbitrary SQL queries against the application database, leading to unauthorized data access, modification, or deletion.

Affected Products

• SourceCodester Home Owners Collection Management System 1.0
• /classes/Master.php endpoint with the delete_category action handler
• Deployments exposing the id parameter without input validation

Discovery Timeline

• 2024-07-02 - CVE-2024-6440 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6440

Vulnerability Analysis

The vulnerability exists in the delete_category handler within /classes/Master.php. The application accepts the id parameter directly from the HTTP request and concatenates it into a SQL DELETE statement without parameterization or sanitization. An authenticated attacker can submit crafted input that breaks out of the intended query context and appends arbitrary SQL clauses.

The attack is remotely exploitable over the network and requires only low privileges. Successful exploitation impacts the confidentiality, integrity, and availability of stored records. Because the public proof of concept is available, automated scanners and opportunistic attackers can locate and abuse vulnerable instances. The current EPSS probability is 0.096%, but exposure increases when the application is internet-facing.

Root Cause

The root cause is the absence of prepared statements or input validation when handling the id parameter inside the category deletion routine. The PHP code constructs a raw SQL string by concatenating user-controlled input. This pattern of dynamic query construction is the classic source of [CWE-89] SQL Injection flaws.

Attack Vector

The attacker sends an HTTP request to /classes/Master.php?f=delete_category with a manipulated id value containing SQL syntax. The injected payload is interpreted by the database engine, allowing UNION-based extraction, boolean-based blind extraction, or stacked queries depending on the backend driver configuration. No user interaction is required beyond authenticating with a low-privileged account. Refer to the published GitHub SQL Vulnerability Guide and VulDB #270168 for additional technical context.

Detection Methods for CVE-2024-6440

Indicators of Compromise

• HTTP requests to /classes/Master.php?f=delete_category containing SQL meta-characters such as ', --, UNION, or SLEEP( in the id parameter
• Database error messages logged after requests to the delete_category endpoint
• Unexpected deletions or modifications in category-related database tables
• Spike in 500-series HTTP responses originating from Master.php

Detection Strategies

• Inspect web server access logs for non-numeric values in the id query string parameter targeting delete_category
• Deploy a Web Application Firewall (WAF) rule that blocks SQL injection signatures on the affected endpoint
• Correlate authentication events with subsequent abnormal query patterns to identify abused low-privileged accounts

Monitoring Recommendations

• Enable database query logging and alert on DELETE statements containing tautologies such as OR 1=1
• Forward web and database logs to a centralized analytics platform for cross-source correlation
• Track outbound data volumes from the application database to identify mass extraction attempts

How to Mitigate CVE-2024-6440

Immediate Actions Required

• Restrict access to the Home Owners Collection Management System to trusted networks until a patched version is available
• Audit application user accounts and revoke unused low-privileged credentials that could be abused for exploitation
• Deploy WAF signatures that block SQL injection patterns targeting /classes/Master.php
• Review database logs for evidence of prior exploitation against the delete_category handler

Patch Information

No official vendor patch is currently listed in the NVD references for CVE-2024-6440. Operators should monitor the SourceCodester project for updated releases. In the absence of a vendor fix, replace dynamic SQL construction in Master.php with prepared statements using PDO or mysqli parameter binding, and enforce strict numeric validation on the id parameter.

Workarounds

• Apply server-side input validation that rejects any non-integer value for the id parameter before it reaches the database layer
• Configure the application database account with least-privilege permissions, denying schema modification and cross-table access
• Place the application behind a reverse proxy that normalizes and filters query string parameters

# Example ModSecurity rule blocking SQLi attempts on the vulnerable endpoint
SecRule REQUEST_URI "@contains /classes/Master.php" \
    "chain,phase:2,deny,status:403,id:1006440,msg:'CVE-2024-6440 SQLi attempt'"
    SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"