CVE-2024-6906: Jkev Record Management System SQLi Flaw

CVE-2024-6906 Overview

CVE-2024-6906 is a SQL injection vulnerability in SourceCodester Record Management System 1.0, developed by jkev. The flaw resides in the add_leave_non_user.php file and is triggered through manipulation of the LSS argument. Attackers can exploit this issue remotely with low-privileged access and no user interaction. The exploit has been publicly disclosed under VulDB identifier VDB-271931, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Remote attackers with low privileges can inject arbitrary SQL statements through the LSS parameter, potentially exposing or modifying database records managed by the application.

Affected Products

SourceCodester Record Management System 1.0
jkev record_management_system (CPE: cpe:2.3:a:jkev:record_management_system:1.0)
Deployments exposing add_leave_non_user.php to untrusted networks

Discovery Timeline

2024-07-19 - CVE-2024-6906 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6906

Vulnerability Analysis

The vulnerability is a classic SQL injection issue [CWE-89] in the add_leave_non_user.php endpoint of SourceCodester Record Management System 1.0. The application accepts the LSS request parameter and concatenates it directly into a SQL query without parameterization or input sanitization. An authenticated attacker with minimal privileges can supply crafted SQL syntax through this argument to alter the intended query logic.

Because the exploit is publicly disclosed on GitHub and VulDB, attackers can reproduce the attack with minimal effort. The current EPSS probability is 0.532%, reflecting moderate real-world exploitation likelihood for a disclosed PHP web application flaw. The confidentiality, integrity, and availability impact is limited to the application database rather than the underlying host.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The add_leave_non_user.php script builds a query string by directly interpolating the LSS parameter received from the HTTP request. No prepared statements, parameterized queries, or input validation routines are applied before the value reaches the database driver.

Attack Vector

Exploitation is performed remotely over the network by sending an HTTP request to add_leave_non_user.php with a malicious LSS value. The attacker requires low-level authenticated access to the application but no user interaction. Successful injection allows enumeration of database schemas, exfiltration of stored records, or manipulation of leave and user records tracked by the system.

Technical proof-of-concept details are documented in the GitHub Record Management System Note and VulDB entry #271931.

Detection Methods for CVE-2024-6906

Indicators of Compromise

HTTP requests to add_leave_non_user.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the LSS parameter.
Web server access logs showing repeated requests with encoded payloads (%27, %20OR%20) targeting the LSS argument.
Unexpected database errors or long response times originating from the leave management module.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the LSS parameter on requests to add_leave_non_user.php and block SQL injection signatures.
Enable database query logging and alert on UNION SELECT, INFORMATION_SCHEMA, or stacked-query patterns originating from the application service account.
Correlate authentication events with anomalous access to the leave management endpoint to identify credential misuse.

Monitoring Recommendations

Continuously baseline HTTP request patterns to add_leave_non_user.php and alert on new query-string structures.
Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
Monitor outbound traffic from the database host for signs of data exfiltration following suspicious query activity.

How to Mitigate CVE-2024-6906

Immediate Actions Required

Restrict network exposure of the Record Management System to trusted internal users while a fix is evaluated.
Rotate credentials used by the application's database account and enforce least-privilege permissions on that account.
Audit historical web and database logs for prior exploitation of the LSS parameter.

Patch Information

No vendor advisory or official patch is currently listed in the enriched CVE data. Administrators should track the VulDB entry #271931 for updates and consider migrating to an alternative, actively maintained record management platform if a fix is not released.

Workarounds

Place the application behind a WAF configured to block SQL injection patterns targeting the LSS parameter.
Implement server-side input validation that rejects non-numeric or unexpected values before they reach add_leave_non_user.php.
Refactor the affected query to use parameterized statements (for example, PDO prepared statements) as a source-level remediation.

bash

# Example ModSecurity rule to block SQL injection on the LSS parameter
SecRule REQUEST_URI "@contains /add_leave_non_user.php" \
    "chain,phase:2,deny,status:403,id:1006906,\
    msg:'CVE-2024-6906 SQLi attempt on LSS parameter'"
    SecRule ARGS:LSS "@detectSQLi" "t:none,t:urlDecodeUni"