CVE-2024-7290: Establishment Billing System SQLi Flaw

CVE-2024-7290 Overview

CVE-2024-7290 is a SQL injection vulnerability in SourceCodester Establishment Billing Management System 1.0, developed by oretnom23. The flaw resides in the /manage_tenant.php script, where the id parameter is passed directly into a database query without proper sanitization. Remote attackers can manipulate the id argument to inject arbitrary SQL statements. The exploit has been publicly disclosed through VulDB entry VDB-273159 and a GitHub Gist proof-of-concept. Authentication with low privileges is required to trigger the flaw, but no user interaction is needed. The weakness is tracked as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the id parameter of manage_tenant.php, exposing tenant billing data to unauthorized reads and modifications.

Affected Products

SourceCodester Establishment Billing Management System 1.0
Oretnom23 Establishment Billing Management System (all builds of 1.0)
Deployments referencing cpe:2.3:a:oretnom23:establishment_billing_management_system:1.0

Discovery Timeline

2024-07-31 - CVE-2024-7290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7290

Vulnerability Analysis

The Establishment Billing Management System is a PHP/MySQL web application used to track tenants, rent, and billing records. The manage_tenant.php endpoint accepts a tenant identifier via the id query string parameter and uses it to build a SQL statement that retrieves tenant details. Because the value is concatenated directly into the query, an attacker can append additional SQL clauses to change the query semantics.

Exploitation only requires network access to the application and a low-privileged authenticated session. Successful injection allows attackers to enumerate database tables, extract credentials and billing records, or modify tenant data. Blind and error-based SQL injection techniques both apply, and time-based payloads work on standard MySQL backends. The public proof-of-concept demonstrates data extraction through the id parameter.

Root Cause

The root cause is unsanitized user input in manage_tenant.php. The application concatenates the id request parameter into a SQL statement instead of using parameterized queries or prepared statements. Neither type coercion nor input allow-listing is applied before the value reaches the database driver, matching the pattern described by CWE-89.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker sends a crafted GET request such as GET /manage_tenant.php?id=1'+UNION+SELECT+...-- after authenticating to the application. No client-side interaction is required, and the vulnerability can be exploited using standard tooling such as sqlmap. Refer to the GitHub Gist proof-of-concept and the VulDB entry for payload details.

Detection Methods for CVE-2024-7290

Indicators of Compromise

HTTP requests to /manage_tenant.php where the id parameter contains SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA.
Web server access logs showing repeated requests to manage_tenant.php with encoded payloads or unusually long id values.
Database error messages surfaced in application responses referencing MySQL syntax failures.
Outbound connections or file writes from the web server process shortly after suspicious manage_tenant.php requests.

Detection Strategies

Deploy web application firewall signatures that flag SQL keywords in the id query parameter of manage_tenant.php.
Enable MySQL general or audit logging and alert on queries against the tenants table that contain injected clauses such as UNION SELECT or information_schema.
Correlate authentication events with subsequent access to manage_tenant.php to identify low-privileged accounts probing tenant data.

Monitoring Recommendations

Baseline normal id parameter values as numeric integers and alert on any non-integer input.
Monitor for sudden spikes in 500-series HTTP responses from the billing application, which often accompany injection probing.
Track database query duration outliers that indicate time-based blind SQL injection attempts.

How to Mitigate CVE-2024-7290

Immediate Actions Required

Restrict access to the Establishment Billing Management System to trusted networks or VPN users until a fix is applied.
Rotate database credentials and application user passwords if injection activity is suspected.
Deploy a WAF rule that rejects requests to /manage_tenant.php when the id parameter is not a positive integer.
Review database audit logs for unauthorized SELECT, UPDATE, or DROP statements against tenant tables.

Patch Information

No official vendor patch has been published for SourceCodester Establishment Billing Management System 1.0 at the time of the NVD entry. Administrators should treat the application as unpatched and apply source-level fixes: replace concatenated queries in manage_tenant.php with prepared statements using PDO or mysqli_prepare, and cast the id value to an integer with intval() before use. Track the VulDB advisory for any vendor updates.

Workarounds

Add server-side input validation that enforces numeric-only values for the id parameter before it reaches any database call.
Configure the web server to block requests containing SQL metacharacters in query strings targeting manage_tenant.php.
Apply least-privilege database accounts so the application user cannot read from unrelated tables or execute DDL statements.
If the application is not actively required, take it offline until a code-level fix is deployed.

bash

# Example ModSecurity rule to block non-integer id values on manage_tenant.php
SecRule REQUEST_URI "@streq /manage_tenant.php" \
    "chain,id:1002731,phase:2,deny,status:403,\
    msg:'CVE-2024-7290: Non-integer id parameter blocked'"
    SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"