CVE-2024-7117: Online Payroll Management System SQLi Flaw

CVE-2024-7117 Overview

CVE-2024-7117 is a SQL injection vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System through release 20230911. The flaw resides in the /shift_viewmore.php script, where the id parameter is passed to a database query without proper sanitization. A remote attacker with low-level authenticated access can inject arbitrary SQL statements to read, modify, or delete database records. The exploit has been publicly disclosed under VulDB identifier VDB-272448. The vendor was contacted before disclosure but did not respond, and the project uses a rolling release model with no versioned patch available.

Critical Impact

Authenticated remote attackers can manipulate the id parameter in shift_viewmore.php to execute arbitrary SQL and access payroll data.

Affected Products

• MD-MAFUJUL-HASAN Online-Payroll-Management-System up to release 20230911
• Rolling-release builds using the vulnerable shift_viewmore.php endpoint
• Deployments exposing the payroll application to authenticated remote users

Discovery Timeline

• 2024-07-26 - CVE-2024-7117 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7117

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under CWE-89. The shift_viewmore.php script accepts an id value from an incoming HTTP request and concatenates it directly into a SQL statement. Because the input is neither validated nor parameterized, an attacker can append SQL syntax to alter the query.

Successful exploitation exposes payroll records, employee identifiers, salary data, and administrative credentials stored in the backend database. Attackers can also chain the injection with UNION queries or stacked statements depending on the database engine. The Online-Payroll-Management-System is distributed as an open-source PHP application, so exploitation techniques and payload templates transfer easily across deployments.

Root Cause

The root cause is the absence of prepared statements or input sanitization on the id parameter processed by shift_viewmore.php. The application constructs the SQL query using string concatenation, allowing user-controlled data to influence query structure. This is a common pattern in PHP applications that rely on legacy mysqli_query or mysql_query calls rather than parameter binding via PDO.

Attack Vector

Exploitation occurs over the network against an authenticated session with low privileges. An attacker submits a crafted request to /shift_viewmore.php?id=<payload>, where the payload contains SQL syntax such as boolean-based, union-based, or time-based injection patterns. No user interaction is required. The publicly disclosed proof of concept is referenced in the GitHub Security Collections Repository and cataloged as VulDB #272448.

Detection Methods for CVE-2024-7117

Indicators of Compromise

• HTTP requests to /shift_viewmore.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the id parameter
• Unusual database error messages returned to authenticated payroll users
• Unexpected SELECT activity against payroll tables originating from the web application service account
• Outbound connections from the web server to unfamiliar IP addresses following requests to shift_viewmore.php

Detection Strategies

• Enable verbose web server logging and inspect query strings sent to shift_viewmore.php for SQL syntax
• Deploy a web application firewall rule that flags SQL keywords in the id parameter of payroll endpoints
• Correlate authentication logs with subsequent database anomalies to identify low-privilege accounts probing the application
• Baseline normal query patterns to the payroll database and alert on deviations in row counts or query structure

Monitoring Recommendations

• Forward web server and database logs to a centralized analytics platform for correlation
• Monitor for repeated 500-series HTTP responses from shift_viewmore.php, which often indicate injection probing
• Track new administrative accounts, password hash changes, or bulk data exports in the payroll database
• Alert on any process spawned by the web server user, since stacked injection can lead to command execution on misconfigured hosts

How to Mitigate CVE-2024-7117

Immediate Actions Required

• Restrict access to /shift_viewmore.php to trusted internal networks or VPN users until a code fix is in place
• Replace the vulnerable SQL concatenation with parameterized queries using PHP PDO with prepared statements
• Rotate database credentials and audit payroll records for unauthorized changes
• Deploy WAF signatures blocking SQL injection payloads against the payroll application

Patch Information

No official vendor patch is available. The project follows a rolling release model, and the vendor did not respond to disclosure attempts. Operators should apply source-level fixes by replacing string-concatenated queries in shift_viewmore.php with prepared statements and by casting the id parameter to an integer with intval() before use. Reference details are cataloged in VulDB CTI ID #272448 and the VulDB Submission #376889.

Workarounds

• Enforce strict input validation that limits the id parameter to numeric values only
• Configure the database user for the payroll application with least-privilege permissions, denying DROP, ALTER, and FILE operations
• Place the application behind a reverse proxy with SQL injection filtering enabled
• Consider migrating to a maintained payroll platform if the vendor remains unresponsive

# Configuration example: ModSecurity rule to block SQLi against shift_viewmore.php
SecRule REQUEST_URI "@contains /shift_viewmore.php" \
    "id:1007117,phase:2,deny,status:403,\
    chain,msg:'CVE-2024-7117 SQLi attempt on id parameter'"
  SecRule ARGS:id "@rx (?i)(union|select|sleep\(|or\s+1=1|--|;)" "t:none"