CVE-2024-6905: Jkev Record Management System SQLi Flaw

CVE-2024-6905 Overview

CVE-2024-6905 is a SQL injection vulnerability in SourceCodester Record Management System 1.0, developed by jkev. The flaw resides in the view_info_user.php file, where the id parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to execute arbitrary SQL statements against the backing database. The vulnerability has been publicly disclosed and assigned the VulDB identifier VDB-271930. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can inject SQL via the id parameter in view_info_user.php, exposing or modifying database contents.

Affected Products

jkev Record Management System 1.0
view_info_user.php endpoint
Deployments exposing the application to untrusted networks

Discovery Timeline

2024-07-19 - CVE-2024-6905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6905

Vulnerability Analysis

The vulnerability affects the view_info_user.php script in jkev Record Management System 1.0. The script accepts an id argument through an HTTP request and passes it into an SQL query without input validation or parameterized queries. An attacker can append SQL syntax to the id value, altering the query logic executed by the backend database.

The issue is exploitable over the network and requires low-privileged access to the application. Successful exploitation allows attackers to read, modify, or delete records within the application's database. The public disclosure of exploitation details increases the likelihood of opportunistic attacks against exposed instances.

Root Cause

The root cause is the direct concatenation of user-supplied input into an SQL statement. The view_info_user.php handler does not apply prepared statements, parameter binding, or input filtering to the id argument before it reaches the database driver.

Attack Vector

An attacker sends a crafted HTTP request to view_info_user.php with a malicious payload appended to the id query string parameter. The database executes the tampered SQL, returning attacker-controlled results or performing unintended operations. Refer to the GitHub Vulnerability Report and VulDB entry #271930 for the disclosed proof-of-concept details.

No verified exploit code is reproduced here. The referenced advisories describe manipulation of the id parameter with standard union-based and boolean-based SQL injection techniques.

Detection Methods for CVE-2024-6905

Indicators of Compromise

HTTP requests to view_info_user.php containing SQL keywords such as UNION, SELECT, SLEEP, OR 1=1, or comment sequences (--, #) in the id parameter.
Web server logs showing unusually long or URL-encoded id values.
Database error messages or abnormal response sizes correlated with requests to the vulnerable endpoint.

Detection Strategies

Deploy a web application firewall (WAF) with SQL injection signatures targeting the id parameter of view_info_user.php.
Enable database query logging and alert on queries referencing the users table with unexpected clauses.
Correlate web access logs with database audit logs to identify suspicious query patterns.

Monitoring Recommendations

Monitor authenticated user sessions for anomalous request volumes to view_info_user.php.
Track HTTP 500 responses from the application, which often indicate probing for SQL injection.
Review outbound network connections from the database host for signs of data exfiltration.

How to Mitigate CVE-2024-6905

Immediate Actions Required

Restrict network access to the Record Management System to trusted users and networks only.
Audit application logs for prior exploitation attempts against view_info_user.php.
Rotate database credentials and review user records for unauthorized modification.

Patch Information

No vendor patch has been published for jkev Record Management System 1.0 at the time of writing. Consult the VulDB advisory for updated remediation status. Operators should refactor view_info_user.php to use parameterized queries with prepared statements via PDO or mysqli.

Workarounds

Place the application behind a WAF configured to block SQL metacharacters in the id parameter.
Enforce least-privilege database accounts so the application user cannot execute destructive statements.
Disable or remove the view_info_user.php endpoint if it is not required for business operations.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains view_info_user.php" \
    "chain,deny,status:403,id:1006905,msg:'CVE-2024-6905 SQLi attempt'"
    SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|or\s+1=1|--|#)" \
        "t:none,t:urlDecodeUni"