CVE-2024-7198: Complaints Report Management System SQLi

CVE-2024-7198 Overview

CVE-2024-7198 is a SQL injection vulnerability in SourceCodester Complaints Report Management System 1.0, developed by oretnom23. The flaw resides in the /admin/manage_station.php script, where the id parameter is passed to a database query without proper sanitization [CWE-89]. Attackers can manipulate this parameter remotely to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed installations. The vulnerability requires low-privilege authenticated access to reach the affected admin endpoint.

Critical Impact
Remote attackers with low privileges can inject SQL statements via the id parameter in /admin/manage_station.php, leading to unauthorized data access, modification, or exposure of application data.

Affected Products

SourceCodester Complaints Report Management System 1.0
oretnom23 complaints_report_management_system 1.0
CPE: cpe:2.3:a:oretnom23:complaints_report_management_system:1.0

Discovery Timeline

2024-07-29 - CVE-2024-7198 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7198

Vulnerability Analysis

The vulnerability affects the administrative station management functionality in the Complaints Report Management System. The id parameter accepted by /admin/manage_station.php is concatenated directly into a SQL query without parameterization or escaping. An authenticated attacker can supply crafted input to alter query logic, extract data from adjacent tables, or bypass intended filtering. The EPSS probability sits at 0.532% (42.1 percentile), reflecting a modest but non-trivial likelihood of exploitation attempts in the wild.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application constructs SQL statements using untrusted request input for the id argument. Because no prepared statements or input validation are applied, attacker-controlled SQL syntax reaches the database engine.

Attack Vector

Exploitation occurs over the network against the /admin/manage_station.php endpoint. The attacker requires authenticated access with low privileges to submit requests carrying a malicious id value. A proof-of-concept has been published publicly, described in the GitHub Gist PoC and cataloged as VulDB #272619. Successful injection can lead to disclosure of complaint records, station data, and administrator credentials stored in the backend database.

No verified exploit code is reproduced here. Refer to the vendor and third-party references for technical details of the injection payload.

Detection Methods for CVE-2024-7198

Indicators of Compromise

HTTP requests to /admin/manage_station.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id parameter.
Web server logs showing repeated 500-series errors or long response times from the manage_station.php endpoint.
Database logs containing malformed queries referencing the stations or users tables from the admin interface.

Detection Strategies

Deploy web application firewall rules that inspect query string parameters to /admin/* endpoints for SQL injection patterns.
Correlate authentication events with unusual admin-page request bursts to identify credential-based access followed by injection attempts.
Enable database query logging and alert on syntactically invalid queries originating from the application service account.

Monitoring Recommendations

Monitor outbound egress from the web server for unexpected data transfers that may indicate exfiltration through injected queries.
Track admin session activity for anomalous request rates against manage_station.php.
Review VulDB entries VulDB CTI ID #272619 for evolving threat intelligence on this CVE.

How to Mitigate CVE-2024-7198

Immediate Actions Required

Restrict network access to the /admin/ directory to trusted IP ranges using firewall or reverse-proxy rules.
Enforce strong, unique credentials on all administrative accounts and disable unused admin users.
Deploy a web application firewall with signatures for SQL injection targeting PHP applications.

Patch Information

No vendor patch is currently listed in the enriched CVE data. SourceCodester Complaints Report Management System 1.0 is affected, and administrators should monitor the vendor for future releases. Given the absence of an official fix, migration to an actively maintained equivalent application is recommended for production environments.

Workarounds

Modify /admin/manage_station.php to use parameterized queries via PDO or mysqli prepared statements for the id parameter.
Add server-side input validation that rejects non-integer values before the parameter reaches the database layer.
Place the application behind an authenticated reverse proxy that filters SQL injection payloads at the perimeter.

bash

# Example Apache configuration to block SQL metacharacters in the id parameter
<Location "/admin/manage_station.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (?:')|(?:--)|(?:\bunion\b)|(?:\bselect\b) [NC]
    RewriteRule .* - [F,L]
</Location>