CVE-2024-6969: Clinic's Patient Management System SQLI Flaw

CVE-2024-6969 Overview

CVE-2024-6969 is a SQL injection vulnerability in SourceCodester Clinic's Patient Management System 1.0, developed by oretnom23. The flaw resides in /ajax/get_patient_history.php, where the patient_id parameter is passed to the backend database without proper sanitization [CWE-89]. Remote attackers with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed instances. The vulnerability is tracked as VulDB entry VDB-272123.

Critical Impact

Authenticated remote attackers can inject arbitrary SQL through the patient_id parameter, exposing patient records and enabling database manipulation in affected clinic management deployments.

Affected Products

• SourceCodester Clinic's Patient Management System 1.0
• Vendor: oretnom23
• Vulnerable component: /ajax/get_patient_history.php

Discovery Timeline

• 2024-07-22 - CVE-2024-6969 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6969

Vulnerability Analysis

The vulnerability affects the AJAX endpoint responsible for retrieving patient history records. The application accepts a patient_id value from the client and concatenates it directly into a SQL query executed against the backend database. Because the input is neither validated nor bound as a parameter, attackers can append additional SQL syntax to the request. Successful exploitation allows extraction of sensitive patient records, modification of stored data, and potential enumeration of the underlying database schema.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The get_patient_history.php handler builds queries via string concatenation rather than prepared statements or parameterized queries. This design allows adversary-controlled characters such as single quotes, UNION keywords, and comment sequences to alter the query structure.

Attack Vector

Exploitation occurs remotely over the network against the vulnerable AJAX endpoint. An attacker who can reach the application and hold low-privileged access supplies a crafted patient_id value in a request to /ajax/get_patient_history.php. No user interaction is required. Because the exploit has been publicly disclosed through the GitHub CVE Analysis and cataloged in VulDB #272123, attackers can readily reproduce the technique against exposed installations.

No verified proof-of-concept code is reproduced here. Refer to the linked references for technical payload examples and request structure.

Detection Methods for CVE-2024-6969

Indicators of Compromise

• HTTP requests to /ajax/get_patient_history.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP() in the patient_id parameter.
• Web server logs showing abnormally long patient_id values or non-numeric input where numeric IDs are expected.
• Database error messages returned to clients referencing MySQL syntax errors originating from patient history queries.

Detection Strategies

• Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting the patient_id parameter on the get_patient_history.php endpoint.
• Enable database query auditing to identify unexpected UNION-based or boolean-based queries against the patient records table.
• Correlate authentication logs with anomalous query volume from single sessions to identify credentialed abuse.

Monitoring Recommendations

• Forward web server access logs and database audit trails to a centralized SIEM for continuous analysis.
• Alert on HTTP 500 responses from /ajax/get_patient_history.php that may indicate injection probing.
• Monitor outbound traffic from the application server for signs of data exfiltration following suspicious queries.

How to Mitigate CVE-2024-6969

Immediate Actions Required

• Restrict network access to the Clinic's Patient Management System to trusted internal networks or VPN users.
• Review web server and database logs for prior exploitation attempts against /ajax/get_patient_history.php.
• Rotate database credentials and audit accounts if evidence of injection is discovered.

Patch Information

No vendor patch has been published for CVE-2024-6969 at the time of writing. Refer to the VulDB advisory and GitHub CVE Analysis for the latest guidance. Organizations running SourceCodester Clinic's Patient Management System 1.0 should evaluate alternatives or apply source-level fixes.

Workarounds

• Modify get_patient_history.php to use prepared statements with bound parameters (for example, PDO with bindParam) instead of concatenating patient_id into the SQL string.
• Enforce strict server-side input validation, accepting only integer values for patient_id and rejecting all other input.
• Deploy a WAF with SQL injection signatures in front of the application until source-level remediation is completed.
• Apply least-privilege permissions to the application's database account to limit the blast radius of a successful injection.

# Example WAF rule concept (ModSecurity) to block SQLi in patient_id
SecRule ARGS:patient_id "@rx (?i)(union|select|sleep|--|;|')" \
    "id:1006969,phase:2,deny,status:403,\
    msg:'Potential SQLi in patient_id (CVE-2024-6969)'"