CVE-2024-7118: Online Payroll Management System SQLi Flaw

CVE-2024-7118 Overview

CVE-2024-7118 is a SQL injection vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System through release 20230911. The flaw resides in /department_viewmore.php, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires only low-privilege authentication. The exploit details have been publicly disclosed via VulDB entry VDB-272449. Because the vendor uses a rolling release model and did not respond to disclosure, no patched version is available.

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter to read, modify, or exfiltrate payroll data stored in the backend database.

Affected Products

MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911
Component: /department_viewmore.php
CWE classification: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command

Discovery Timeline

2024-07-26 - CVE-2024-7118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7118

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in a PHP-based payroll application. The department_viewmore.php script accepts the id HTTP parameter and concatenates it directly into a SQL query. This behavior allows an attacker to break out of the intended query context and append attacker-controlled SQL syntax.

Because the injection point is reachable over the network and requires only low privileges, any authenticated user of the payroll application can trigger it. Successful exploitation impacts confidentiality, integrity, and availability of database contents at a limited level, according to the CVSS 4.0 vector. The EPSS score of 0.542% places exploitation likelihood in the lower percentile range, but public disclosure of the technique on GitHub increases opportunistic risk.

Root Cause

The root cause is missing input sanitization and the absence of parameterized queries in /department_viewmore.php. The id parameter is treated as trusted input and inserted into a SQL statement. No prepared statements, type casting, or allowlist validation is applied before the query executes against the payroll database.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /department_viewmore.php with a malicious value in the id query string parameter. Injected payloads can include boolean-based, error-based, union-based, or time-based SQL injection techniques. Attackers can enumerate database schemas, extract employee salary records, escalate to reading credential tables, or corrupt payroll entries.

The vulnerability requires no user interaction. Exploitation techniques for SQL injection against PHP applications are well documented. See the GitHub Security Collections Repository and VulDB #272449 for the disclosed proof-of-concept details.

Detection Methods for CVE-2024-7118

Indicators of Compromise

HTTP requests to /department_viewmore.php containing SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP( in the id parameter.
Web server access logs showing unusually long id values or URL-encoded SQL syntax against the payroll endpoint.
Database error messages appearing in application responses, indicating error-based injection attempts.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter for SQL injection signatures on the payroll application path.
Enable database query logging and alert on unexpected query structures originating from the payroll service account.
Correlate authentication events with anomalous query volumes to identify low-privilege accounts abusing the injection.

Monitoring Recommendations

Monitor for repeated HTTP 500 responses from /department_viewmore.php, which often accompany injection probing.
Track outbound database traffic volume for spikes consistent with data exfiltration through injected UNION queries.
Alert on schema enumeration queries against information_schema from the payroll application's database user.

How to Mitigate CVE-2024-7118

Immediate Actions Required

Restrict network access to the Online-Payroll-Management-System to trusted internal networks or via VPN until a fix is applied.
Disable or remove access to /department_viewmore.php if the functionality is not essential to operations.
Rotate database credentials used by the application if injection activity is suspected in logs.
Audit database contents for unauthorized modifications to payroll and employee records.

Patch Information

The vendor uses a rolling release model and, per the CVE record, did not respond to disclosure attempts. No official patched version has been published. Organizations should apply source-level fixes by replacing the vulnerable query in /department_viewmore.php with a parameterized statement using PDO or mysqli prepared statements, and by casting the id value to an integer before use.

Workarounds

Place a WAF in front of the application and enable OWASP Core Rule Set signatures for SQL injection.
Enforce least-privilege database accounts so the application user cannot read sensitive tables or execute DDL statements.
Apply input validation at a reverse proxy to reject non-numeric id values before they reach the PHP application.
Consider migrating to an actively maintained payroll application if vendor support is unavailable.

bash

# Example nginx location block to enforce numeric id parameter
location /department_viewmore.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}