CVE-2024-7308: Establishment Billing System SQLi Flaw

CVE-2024-7308 Overview

CVE-2024-7308 is a SQL injection vulnerability in SourceCodester Establishment Billing Management System 1.0. The flaw resides in the /view_bill.php script, where the id request parameter is passed directly into a database query without sanitization. Remote attackers with low-level privileges can manipulate the id argument to inject arbitrary SQL statements. The issue is tracked as VulDB entry VDB-273200 and maps to [CWE-89: SQL Injection]. Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated remote attackers can inject SQL through the id parameter in /view_bill.php to read, modify, or delete billing records stored in the backend database.

Affected Products

Oretnom23 Establishment Billing Management System 1.0
SourceCodester distribution of Establishment Billing Management System
Deployments referenced by CPE cpe:2.3:a:oretnom23:establishment_billing_management_system:1.0

Discovery Timeline

2024-07-31 - CVE-2024-7308 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7308

Vulnerability Analysis

The vulnerability exists in the view_bill.php endpoint of the Establishment Billing Management System. The script accepts an id query parameter that identifies which bill record to display. This value is concatenated into a SQL statement without parameterization or input validation. An attacker supplies crafted SQL fragments through the id argument to alter the intended query. The result is arbitrary SQL execution in the context of the application database user. Because the attack is delivered over HTTP, exploitation requires only network access to the application and a valid low-privilege session.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The application builds queries through direct string concatenation of untrusted input. No prepared statements, parameter binding, or input allowlists are applied to the id parameter before it reaches the database driver. This design flaw allows attacker-controlled data to be interpreted as SQL syntax.

Attack Vector

Exploitation is remote and uses the HTTP GET or POST request that carries the id parameter to /view_bill.php. An attacker appends SQL metacharacters and payloads such as UNION SELECT clauses or boolean conditions to enumerate tables, extract credentials, or manipulate billing data. Public proof-of-concept material is referenced in the GitHub Gist PoC and VulDB entry #273200. Refer to those advisories for the exact payload structure rather than synthesized examples.

Detection Methods for CVE-2024-7308

Indicators of Compromise

HTTP requests to /view_bill.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the id parameter.
Web server or application logs showing unusually long or URL-encoded id values inconsistent with normal numeric identifiers.
Database error messages referencing syntax errors triggered by view_bill.php requests.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter for SQL syntax patterns and block requests deviating from an integer allowlist.
Enable database query logging and alert on queries originating from view_bill.php that contain UNION, INFORMATION_SCHEMA, or time-based functions.
Correlate authentication logs with view_bill.php request spikes to identify credentialed attackers probing the parameter.

Monitoring Recommendations

Monitor outbound egress from the web server for data exfiltration patterns following suspicious view_bill.php traffic.
Track database user activity for unexpected read access to sensitive tables such as user or credential stores.
Retain HTTP access logs for at least 90 days to support retrospective hunting once new indicators emerge.

How to Mitigate CVE-2024-7308

Immediate Actions Required

Restrict network access to the Establishment Billing Management System to trusted internal users while a fix is evaluated.
Place the application behind a WAF configured to block SQL injection patterns on the id parameter.
Rotate database credentials and any application secrets that may have been exposed through exploitation attempts.
Audit database contents for unauthorized modifications to billing, user, or configuration tables.

Patch Information

No vendor advisory or official patch has been published for CVE-2024-7308 at the time of writing. Organizations running Establishment Billing Management System 1.0 should treat the deployment as unsupported and either replace the application or apply source-level fixes. The corrective change is to replace concatenated SQL in view_bill.php with parameterized queries or prepared statements, and to cast the id value to an integer before use.

Workarounds

Modify view_bill.php locally to enforce intval($_GET['id']) (or equivalent) before the value reaches any SQL statement.
Apply least-privilege permissions to the database account used by the application so it cannot read or modify tables outside its functional scope.
Disable or remove the /view_bill.php endpoint if it is not required for business operations.

bash

# Example WAF rule concept (ModSecurity) to block SQLi in the id parameter
SecRule ARGS:id "@rx [^0-9]" \
    "id:1002731,phase:2,deny,status:403,log,\
    msg:'CVE-2024-7308 - Non-numeric id parameter on view_bill.php',\
    chain"
    SecRule REQUEST_URI "@streq /view_bill.php"