CVE-2024-7371: Simple Realtime Quiz System SQLi Flaw

CVE-2024-7371 Overview

CVE-2024-7371 is a SQL injection vulnerability in SourceCodester Simple Realtime Quiz System 1.0. The flaw resides in the /quiz_view.php script, where the id parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The issue is tracked under identifier VDB-273355 and maps to [CWE-89]. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Authenticated remote attackers can inject SQL through the id parameter in /quiz_view.php, leading to unauthorized read and write access to backend database records.

Affected Products

Oretnom23 Simple Realtime Quiz System 1.0
CPE: cpe:2.3:a:oretnom23:simple_realtime_quiz_system:1.0
Vulnerable component: /quiz_view.php (id parameter)

Discovery Timeline

2024-08-01 - CVE-2024-7371 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7371

Vulnerability Analysis

The Simple Realtime Quiz System exposes a quiz detail page at /quiz_view.php that accepts an id query parameter to identify which quiz record to render. The application concatenates this attacker-controlled value directly into a SQL statement without parameterization or escaping. As a result, attackers can append SQL syntax to alter the query logic.

The EPSS score of 0.509% reflects a low but non-trivial probability of exploitation, consistent with public PoC availability. Because the attack requires only a low-privileged session and can be launched over the network, mass scanners can weaponize the flaw against exposed deployments.

Successful exploitation enables data disclosure from quiz, user, and session tables. Depending on the database user privileges, attackers may also modify or delete records. The vulnerability is categorized as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Root Cause

The root cause is direct string concatenation of the id HTTP parameter into a SQL query. The code path does not use prepared statements, parameter binding, or input validation. Any client capable of reaching the endpoint can inject SQL metacharacters such as single quotes, UNION, and boolean operators to alter query semantics.

Attack Vector

An attacker sends a crafted GET request to /quiz_view.php?id=<payload> containing SQL syntax. Typical payloads include UNION SELECT statements to extract data from other tables, boolean-based blind checks, or time-based payloads using SLEEP() to confirm injection when responses are not directly reflected. The public gist referenced in VulDB #273355 demonstrates a working payload against the id parameter. See the GitHub Gist PoC for technical details.

Detection Methods for CVE-2024-7371

Indicators of Compromise

HTTP requests to /quiz_view.php containing SQL keywords such as UNION, SELECT, SLEEP(, --, or information_schema in the id parameter.
Unusually long or URL-encoded id values that deviate from expected numeric quiz identifiers.
Database error strings returned in HTTP responses indicating malformed SQL execution.
Spikes in /quiz_view.php traffic from a single source IP with sequential parameter variations.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter for SQL metacharacters and reject non-integer values.
Enable database query logging and alert on queries against quiz tables containing UNION, OR 1=1, or nested SELECT clauses.
Correlate web access logs with database audit logs to identify injected queries originating from /quiz_view.php.

Monitoring Recommendations

Forward web server and PHP application logs to a centralized analytics platform for retention and correlation.
Monitor authentication and session tables for unexpected reads by the application database user.
Alert on outbound data transfer volume anomalies that could indicate database exfiltration.

How to Mitigate CVE-2024-7371

Immediate Actions Required

Restrict access to /quiz_view.php behind authentication controls and IP allowlists until a fix is applied.
Deploy WAF signatures that block SQL injection payloads targeting the id parameter.
Enforce type validation at the reverse proxy layer to reject non-integer id values.
Review database and web server logs for prior exploitation attempts against the endpoint.

Patch Information

No vendor patch has been published for Simple Realtime Quiz System 1.0 at the time of NVD publication. Operators should treat the affected version as end-of-support and plan migration to an actively maintained quiz platform. Consult VulDB CTI ID #273355 for advisory updates.

Workarounds

Modify /quiz_view.php to use prepared statements with parameter binding instead of string concatenation.
Cast the id value to an integer using intval($_GET['id']) before it reaches the SQL layer.
Apply the principle of least privilege to the database account used by the application, removing write and schema access where possible.
Take the application offline if it is not business-critical, given no vendor patch exists.

bash

# Configuration example: ModSecurity rule to block SQL metacharacters in the id parameter
SecRule ARGS:id "@rx [^0-9]" \
    "id:1002741,\
    phase:2,\
    deny,\
    status:400,\
    msg:'Non-integer id parameter blocked (CVE-2024-7371)',\
    tag:'CWE-89'"