CVE-2024-7289: Establishment Billing Management System SQLi

CVE-2024-7289 Overview

CVE-2024-7289 is a SQL injection vulnerability in SourceCodester Establishment Billing Management System 1.0, developed by oretnom23. The flaw resides in the /manage_payment.php endpoint, where the id parameter is passed directly into a database query without proper sanitization. Remote attackers with low privileges can manipulate the id argument to execute arbitrary SQL statements against the backend database. The exploit has been publicly disclosed under VulDB identifier VDB-273158, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the id parameter of manage_payment.php, exposing billing data and enabling database manipulation.

Affected Products

Oretnom23 Establishment Billing Management System 1.0
SourceCodester Establishment Billing Management System 1.0
CPE: cpe:2.3:a:oretnom23:establishment_billing_management_system:1.0

Discovery Timeline

2024-07-31 - CVE-2024-7289 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7289

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The manage_payment.php script accepts an id parameter through an HTTP request and concatenates it into a SQL query without parameterization or input validation. Attackers can supply crafted payloads containing SQL metacharacters such as ', UNION SELECT, or boolean-based conditions to alter query logic. Successful exploitation allows extraction of sensitive billing records, credential hashes, and potentially full database enumeration through techniques such as UNION-based or error-based injection.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in the PHP handler for manage_payment.php. User-controlled data flows directly into a SQL query string, allowing attacker-supplied fragments to be interpreted as query syntax rather than data.

Attack Vector

Exploitation requires network access to the web application and low-level authenticated privileges. An attacker sends an HTTP request to /manage_payment.php with a manipulated id value. Because the attack is remote and does not require user interaction, automated scanners and mass-exploitation tools can trigger the flaw against internet-facing deployments. A proof-of-concept payload is publicly hosted on a GitHub Gist PoC Repository.

No verified, non-malicious exploit code is reproduced here. Refer to the VulDB entry #273158 for full technical detail.

Detection Methods for CVE-2024-7289

Indicators of Compromise

HTTP requests targeting /manage_payment.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the id parameter.
Unexpected database errors or long-running queries originating from the billing application's database user.
Web server access logs showing repeated requests to manage_payment.php from a single source with variations in the id value.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects query strings and POST bodies to manage_payment.php for common SQL injection signatures.
Enable database query logging and alert on syntactically anomalous statements against the billing schema.
Correlate web server logs with database audit logs to identify request-to-query pairs that indicate injection attempts.

Monitoring Recommendations

Monitor outbound traffic from the web server for signs of data exfiltration following suspicious manage_payment.php requests.
Track authentication attempts and session activity for accounts interacting with the billing module.
Baseline normal request patterns to /manage_payment.php and alert on statistical deviations in parameter length or character distribution.

How to Mitigate CVE-2024-7289

Immediate Actions Required

Restrict network exposure of the Establishment Billing Management System by placing it behind a VPN or IP allow-list until a patch is applied.
Deploy WAF signatures that block SQL injection payloads targeting the id parameter on /manage_payment.php.
Rotate database credentials and audit the billing database for unauthorized modifications or data access.

Patch Information

No official vendor patch is listed in the NVD or VulDB references for CVE-2024-7289. Organizations should track the VulDB CTI record #273158 and the SourceCodester project pages for future updates. In the absence of a vendor fix, consider decommissioning the application or forking the source to apply a manual fix that uses parameterized queries (PDO::prepare with bound parameters or mysqli_stmt_bind_param).

Workarounds

Modify manage_payment.php to cast id to an integer using intval($_REQUEST['id']) before use, or replace inline SQL with prepared statements.
Enforce least-privilege on the database account used by the application so it cannot read from unrelated tables or execute administrative statements.
Disable or remove the manage_payment.php endpoint if it is not required in production.

bash

# Example hardening: enforce least privilege for the billing DB user
mysql -u root -p <<'SQL'
REVOKE ALL PRIVILEGES ON *.* FROM 'billing_app'@'%';
GRANT SELECT, INSERT, UPDATE ON billing_db.payments TO 'billing_app'@'%';
FLUSH PRIVILEGES;
SQL