CVE-2024-7361: Oretnom23 Tracking Management SQLi Flaw

CVE-2024-7361 Overview

CVE-2024-7361 is a SQL injection vulnerability in SourceCodester Tracking Monitoring Management System 1.0. The flaw resides in /ajax.php?action=save_establishment, where the id parameter is concatenated into a database query without proper sanitization. Attackers can exploit the issue remotely without prior authentication beyond low-privilege access. A public proof-of-concept exists, increasing the likelihood of opportunistic exploitation against exposed installations. The vulnerability is tracked in VulDB as entry 273340 and maps to CWE-89, SQL Injection.

Critical Impact

Remote attackers can manipulate the id parameter to inject arbitrary SQL statements, potentially exposing or altering data stored in the application's database.

Affected Products

• Oretnom23 (SourceCodester) Tracking Monitoring Management System 1.0
• Component: /ajax.php endpoint with action=save_establishment
• Vulnerable parameter: id

Discovery Timeline

• 2024-08-01 - CVE-2024-7361 published to the National Vulnerability Database (NVD)
• 2024-08-09 - Last updated in NVD database

Technical Details for CVE-2024-7361

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP-based AJAX endpoint. When a request invokes /ajax.php?action=save_establishment, the application passes the supplied id argument directly into a SQL statement. Because the parameter is not validated, escaped, or bound through a prepared statement, attacker-supplied SQL syntax is interpreted by the database engine.

Exploitation requires only network reachability to the web application and a valid request path. The attacker submits crafted input through the id parameter to alter the structure of the underlying query. Successful exploitation can yield unauthorized data reads, data modification, or authentication state manipulation depending on the privileges of the database account.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command, mapped to [CWE-89]. The save_establishment action handler in ajax.php constructs queries through string concatenation rather than parameterized statements, allowing the id value to break out of the intended query context.

Attack Vector

The attack vector is network-based and remote. An attacker sends an HTTP request to /ajax.php?action=save_establishment containing a malicious id payload. Because the proof-of-concept has been published publicly, automated scanners and opportunistic actors can replicate the technique against internet-exposed deployments. Refer to the GitHub Gist proof-of-concept for the disclosed request structure.

Detection Methods for CVE-2024-7361

Indicators of Compromise

• HTTP requests to /ajax.php?action=save_establishment containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the id parameter
• Unusual database errors logged by the application following requests to the save_establishment action
• Outbound network connections or DNS lookups originating from the database host immediately after requests targeting the vulnerable endpoint

Detection Strategies

• Inspect web server access logs for action=save_establishment requests with non-numeric or URL-encoded id values
• Enable database query logging and alert on syntactically invalid statements referencing the establishment table
• Deploy web application firewall (WAF) signatures for SQL injection patterns scoped to the /ajax.php path

Monitoring Recommendations

• Forward web server and database logs to a centralized analytics platform for correlation against known injection signatures
• Baseline normal request volume and parameter types for the save_establishment endpoint and alert on deviations
• Monitor the application's database service account for unexpected schema enumeration queries against information_schema

How to Mitigate CVE-2024-7361

Immediate Actions Required

• Restrict external access to the Tracking Monitoring Management System until the application is hardened
• Review web and database logs for prior exploitation against /ajax.php?action=save_establishment
• Rotate database credentials and application session secrets if exploitation indicators are present

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2024-7361. Operators of SourceCodester Tracking Monitoring Management System 1.0 should track the VulDB advisory for remediation updates and consider replacing the affected build with a maintained version when available.

Workarounds

• Rewrite the save_establishment handler to use parameterized queries or prepared statements for the id parameter
• Apply server-side input validation that enforces an integer type and range on id before it reaches the data access layer
• Deploy a WAF rule that blocks SQL metacharacters in requests to /ajax.php until source-level fixes are applied
• Run the application's database account with least privilege, removing rights to DROP, ALTER, and cross-database reads

# Example ModSecurity rule to block SQLi payloads against the vulnerable endpoint
SecRule REQUEST_URI "@contains /ajax.php" \
  "chain,phase:2,deny,status:403,id:1007361,msg:'CVE-2024-7361 SQLi attempt'"
  SecRule ARGS:action "@streq save_establishment" \
    "chain"
    SecRule ARGS:id "@detectSQLi" "t:none,t:urlDecodeUni"