CVE-2024-7373: Simple Realtime Quiz System SQLi Flaw

CVE-2024-7373 Overview

CVE-2024-7373 is a SQL injection vulnerability in SourceCodester Simple Realtime Quiz System 1.0, developed by oretnom23. The flaw resides in the /ajax.php?action=load_answered endpoint, where the id parameter is not properly sanitized before being used in a database query [CWE-89]. Remote attackers can manipulate the id argument to inject arbitrary SQL statements. The vulnerability requires low-privilege authentication but no user interaction. Public exploit details have been disclosed through VulDB (VDB-273357) and a GitHub Gist, increasing exposure for unpatched deployments.

Critical Impact
Authenticated remote attackers can inject SQL commands through the id parameter to read, modify, or exfiltrate data from the backend database.

Affected Products

SourceCodester Simple Realtime Quiz System 1.0
oretnom23 simple_realtime_quiz_system version 1.0
Deployments exposing /ajax.php?action=load_answered

Discovery Timeline

2024-08-02 - CVE-2024-7373 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7373

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw affecting the AJAX handler in Simple Realtime Quiz System 1.0. The application processes requests to /ajax.php?action=load_answered and passes the id parameter directly into a SQL query without parameterization or input validation. Attackers can supply crafted values for id to alter query logic, retrieve arbitrary rows, or extract sensitive database contents. The attack is executed over the network and requires only low privileges within the application. Public disclosure of exploitation details raises the likelihood of opportunistic scanning against exposed instances.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The id parameter received through the AJAX endpoint is concatenated into a SQL statement rather than bound as a prepared parameter. This design allows attacker-controlled input to modify query syntax and semantics.

Attack Vector

An attacker sends a crafted HTTP request to /ajax.php?action=load_answered with a malicious payload in the id argument. Because the vector is network-based and remotely reachable, exploitation can be automated against any exposed installation. Refer to the VulDB entry and the GitHub Gist PoC for public technical details.

No verified exploit code is reproduced here.
See the linked VulDB entry and GitHub Gist for public proof-of-concept details.

Detection Methods for CVE-2024-7373

Indicators of Compromise

HTTP requests to /ajax.php?action=load_answered containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id parameter.
Anomalous database errors or unusually large response payloads returned from the load_answered action.
Sudden spikes of authenticated requests to ajax.php from a single source IP.

Detection Strategies

Deploy WAF signatures that inspect the id query parameter for SQL injection patterns targeting the load_answered action.
Enable database query logging and alert on syntactically abnormal statements originating from the quiz application user.
Correlate web server access logs with database audit logs to identify parameter tampering.

Monitoring Recommendations

Monitor for repeated 500-series responses tied to /ajax.php requests, which often accompany injection probing.
Track outbound data volumes from the database host to detect potential mass extraction.
Baseline normal id parameter values and alert on non-numeric or overly long inputs.

How to Mitigate CVE-2024-7373

Immediate Actions Required

Restrict access to the Simple Realtime Quiz System behind authentication controls or a VPN until a fix is applied.
Block or rate-limit requests to /ajax.php?action=load_answered from untrusted networks.
Review database and application logs for prior exploitation attempts referencing the id parameter.

Patch Information

No vendor advisory or official patch has been published for CVE-2024-7373 at the time of the NVD entry. Operators should evaluate whether continued use of Simple Realtime Quiz System 1.0 is appropriate given the disclosed exploit. Monitor the VulDB entry for update announcements.

Workarounds

Modify the vulnerable code to use parameterized queries or prepared statements for the id parameter.
Add server-side input validation enforcing that id is a positive integer before passing it to the database layer.
Deploy a web application firewall rule to reject SQL metacharacters targeting the load_answered action.

bash

# Example nginx rule to reject non-numeric id values
location = /ajax.php {
    if ($arg_action = "load_answered") {
        if ($arg_id !~ "^[0-9]+$") {
            return 400;
        }
    }
}