CVE-2024-6967: Employee Gate Pass Logging SQLi Flaw

CVE-2024-6967 Overview

CVE-2024-6967 is a SQL injection vulnerability in SourceCodester Employee and Visitor Gate Pass Logging System version 1.0, developed by oretnom23. The flaw resides in the /employee_gatepass/admin/?page=employee/manage_employee endpoint, where the id parameter is passed to a backend SQL query without proper sanitization. Attackers can manipulate the parameter to inject arbitrary SQL statements remotely. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public disclosure of the exploit technique increases the risk of opportunistic attacks against exposed installations.

Critical Impact
Authenticated remote attackers can extract, modify, or delete data in the application database by injecting SQL into the id parameter of the employee management page.

Affected Products

Oretnom23 Employee and Visitor Gate Pass Logging System 1.0
Component: oretnom23:employee_and_visitor_gate_pass_logging_system
Vulnerable endpoint: /employee_gatepass/admin/?page=employee/manage_employee

Discovery Timeline

2024-07-22 - CVE-2024-6967 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6967

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw affecting the administrative employee management page. The application accepts an id query parameter and concatenates it directly into a SQL statement executed against the backend database. Because the parameter is neither validated nor bound as a parameterized query input, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access to the admin interface and low-privileged authentication, but no user interaction. Successful exploitation allows an attacker to enumerate database schema, exfiltrate employee and visitor records, tamper with logged gate pass entries, or escalate access through credential extraction. The exploit is publicly documented, tracked as VulDB entry 272121.

Root Cause

The root cause is improper neutralization of user-supplied input passed through the id GET parameter on the manage_employee admin page. The application concatenates the parameter into a SQL query string rather than using parameterized statements or prepared queries. This design pattern is a well-known anti-pattern classified under CWE-89.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable admin endpoint, supplying malicious SQL syntax in the id parameter. The request format targets /employee_gatepass/admin/?page=employee/manage_employee&id=<payload>. Because the attack originates over the network and does not require user interaction, it can be automated against internet-exposed instances. Full technical details of the injection payload are documented in the GitHub SQL Vulnerability Details writeup and the VulDB CVE-272121 Threat Report.

No verified sanitized proof-of-concept code is reproduced here. Refer to the public advisory for exploit specifics.

Detection Methods for CVE-2024-6967

Indicators of Compromise

HTTP requests to /employee_gatepass/admin/?page=employee/manage_employee containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- in the id parameter.
Unexpected database errors or long-running queries originating from the manage_employee page in web server logs.
Abnormal outbound traffic from the application server following requests to the affected endpoint, indicating potential data exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter for common SQL injection signatures on the affected URL pattern.
Enable database query logging and alert on queries containing anomalous UNION, INFORMATION_SCHEMA, or boolean-based blind injection patterns.
Correlate authenticated admin session activity with unusual request volume or error rates on the manage_employee endpoint.

Monitoring Recommendations

Monitor authentication logs for compromised or brute-forced admin accounts, since exploitation requires low-privilege credentials.
Track file system and database modifications on the application host to detect post-exploitation persistence attempts.
Alert on any process spawned by the web server user that is not part of normal PHP execution.

How to Mitigate CVE-2024-6967

Immediate Actions Required

Restrict network access to the /employee_gatepass/admin/ interface using IP allowlisting or VPN-only access until a fix is available.
Rotate all administrator credentials and audit the employee and visitor database for signs of tampering or unauthorized reads.
Deploy WAF signatures blocking SQL injection payloads targeting the id parameter on the manage_employee page.

Patch Information

No vendor patch is listed in the referenced advisories at the time of publication. The product is a small open-source PHP application distributed via SourceCodester. Organizations running this software should track the VulDB #272121 entry for updates, apply local code fixes to use parameterized queries with prepared statements, and validate the id parameter as a strict integer before database use.

Workarounds

Modify the affected PHP source to cast the id parameter to an integer (for example, intval($_GET['id'])) before use in any SQL statement.
Replace inline SQL concatenation with PDO or mysqli prepared statements throughout the manage_employee handler and related admin pages.
Disable or remove the vulnerable admin module if the employee management feature is not actively required in production.

bash

# Example WAF rule concept blocking SQLi patterns on the vulnerable endpoint
# Adjust for your WAF engine (ModSecurity syntax shown)
SecRule REQUEST_URI "@contains /employee_gatepass/admin/" \
  "chain,deny,status:403,id:1006967,msg:'CVE-2024-6967 SQLi attempt'"
  SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|')" \
    "t:none,t:urlDecodeUni"