CVE-2024-6951: Simple Online Book Store System SQLi Flaw

CVE-2024-6951 Overview

CVE-2024-6951 is a SQL injection vulnerability in SourceCodester Simple Online Book Store System 1.0, developed by oretnom23. The flaw resides in the admin_delete.php script, where the bookisbn parameter is passed directly into a SQL query without sanitization. Attackers can manipulate this parameter to alter query logic, extract data, or modify database contents. The vulnerability is exploitable remotely over the network and requires only low-privileged authenticated access. The exploit has been publicly disclosed through VulDB entry #272073 and a GitHub CVE PoC Documentation, making opportunistic exploitation likely.

Critical Impact

Remote attackers with low privileges can inject arbitrary SQL through the bookisbn parameter in admin_delete.php, leading to unauthorized data access, modification, or deletion in the application database.

Affected Products

• SourceCodester Simple Online Book Store System 1.0
• oretnom23 simple_online_book_store_system (CPE: cpe:2.3:a:oretnom23:simple_online_book_store_system:1.0)
• Deployments using the unpatched admin_delete.php component

Discovery Timeline

• 2024-07-21 - CVE-2024-6951 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6951

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. The admin_delete.php script accepts the bookisbn HTTP parameter and concatenates it into a SQL DELETE statement without parameterization or input validation. Attackers can submit crafted values containing SQL metacharacters that break out of the intended query context.

Because the affected endpoint performs administrative deletion operations, successful exploitation can lead to unauthorized record removal, boolean-based or union-based data extraction, and tampering with adjacent tables. The attack is fully remote and does not require user interaction, but it does require a valid low-privileged session to reach the administrative endpoint.

Public disclosure through VulDB and a GitHub-hosted proof of concept increases the likelihood of automated scanning and exploitation against exposed instances.

Root Cause

The root cause is the absence of prepared statements or input sanitization in the database query logic of admin_delete.php. User-controlled input from the bookisbn argument is interpolated directly into the SQL string. This pattern allows the SQL parser to interpret attacker-supplied characters such as single quotes, comments, and UNION keywords as query syntax rather than data.

Attack Vector

An attacker accesses admin_delete.php over HTTP and supplies a malicious payload in the bookisbn parameter. The crafted input alters the underlying SQL query, allowing the attacker to retrieve arbitrary data, bypass authentication logic in adjacent flows, or destroy records. The attack requires network reachability to the application and low-level privileges. No client-side interaction is needed.

Detailed exploitation steps are available in the publicly disclosed GitHub CVE PoC Documentation and the VulDB entry #272073.

Detection Methods for CVE-2024-6951

Indicators of Compromise

• HTTP requests to admin_delete.php containing SQL metacharacters in the bookisbn parameter, such as single quotes, --, UNION SELECT, or SLEEP(.
• Unexpected DELETE, UNION, or error-based responses in application or database logs tied to the book store administrative interface.
• Database error messages returned to clients referencing MySQL syntax errors originating from admin_delete.php.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query string and POST parameters submitted to admin_delete.php for SQL injection patterns.
• Enable database query logging and alert on anomalous DELETE volumes or queries containing concatenated user-controlled ISBN values.
• Correlate authentication events with administrative endpoint access to identify low-privileged accounts probing admin scripts.

Monitoring Recommendations

• Monitor outbound traffic from the web server for data exfiltration patterns following suspicious requests to admin_delete.php.
• Track failed and successful SQL operations on book-related tables for statistical anomalies.
• Forward web server, WAF, and database logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2024-6951

Immediate Actions Required

• Restrict network access to the Simple Online Book Store System administrative interface using IP allowlisting or VPN-only access.
• Audit admin_delete.php and refactor the affected query to use parameterized statements with bound parameters for bookisbn.
• Review database logs for prior exploitation attempts and validate the integrity of the books and related tables.

Patch Information

No official vendor advisory or patch has been published for CVE-2024-6951 at the time of NVD publication. Organizations running SourceCodester Simple Online Book Store System 1.0 should treat the deployment as unsupported and apply source-level remediation by replacing direct query concatenation with prepared statements. Consult the VulDB entry #272073 for additional advisory tracking.

Workarounds

• Deploy a WAF rule to block requests to admin_delete.php that contain SQL keywords or metacharacters in the bookisbn parameter.
• Implement server-side input validation that enforces a strict ISBN format (numeric, fixed length) before the value reaches any database query.
• Apply least-privilege database accounts so the web application user cannot perform destructive operations beyond what is strictly required.

# Example ModSecurity rule to block SQL injection patterns on admin_delete.php
SecRule REQUEST_URI "@contains /admin_delete.php" \
    "chain,id:1006951,phase:2,deny,status:403,msg:'CVE-2024-6951 SQLi attempt on bookisbn'"
    SecRule ARGS:bookisbn "@rx (?i)(union(.*?)select|--|';|\bsleep\b|/\*)" "t:none,t:urlDecodeUni"