CVE-2024-7454: Clinic's Patient Management SQL Injection

CVE-2024-7454 Overview

CVE-2024-7454 is a SQL injection vulnerability in SourceCodester Clinics Patient Management System 1.0. The flaw resides in the patient_name parameter handled by the patients.php file. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements into backend database queries. The issue is tracked in VulDB as entry VDB-273548 and is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public disclosure includes proof-of-concept details, increasing exposure for organizations running this application.

Critical Impact

Authenticated attackers can extract, modify, or delete patient records by injecting SQL through the patient_name parameter, putting clinical data confidentiality and integrity at risk.

Affected Products

• Oretnom23 / SourceCodester Clinic's Patient Management System 1.0
• File: patients.php
• Function: patient_name

Discovery Timeline

• 2024-08-04 - CVE-2024-7454 published to NVD
• 2024-09-07 - Last updated in NVD database

Technical Details for CVE-2024-7454

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the patient records workflow of Clinic's Patient Management System 1.0. The application accepts user-controlled input through the patient_name parameter and concatenates it into a SQL query without proper parameterization or escaping. An attacker with low-privileged access to the application can submit crafted input over the network to alter query logic. The EPSS score is 0.087% (percentile 24.788), indicating limited observed exploitation activity at this time. Because the application stores protected health information, successful exploitation can expose sensitive patient data and undermine recordkeeping integrity.

Root Cause

The root cause is improper neutralization of special elements in SQL statements [CWE-89]. The patients.php script passes the patient_name value directly into a database query string. Without prepared statements or input validation, single quotes, comment sequences, and UNION clauses break out of the intended query context.

Attack Vector

The attack is remote and requires only low privileges on the application. An attacker submits malicious payloads through the patient_name field in HTTP requests targeting patients.php. The exploit has been publicly disclosed on the GitHub CVE Resource, lowering the skill required for adversaries to replicate the attack. Additional technical detail is available at VulDB #273548.

No verified exploit code is included in this article. Refer to the linked references for proof-of-concept details.

Detection Methods for CVE-2024-7454

Indicators of Compromise

• HTTP requests to patients.php containing SQL metacharacters such as ', --, UNION SELECT, OR 1=1, or hex-encoded payloads in the patient_name parameter.
• Web server logs showing unusually long patient_name values or repeated requests with incremental payload variations indicative of automated SQLi tooling.
• Database error responses or HTTP 500 entries correlated with patients.php requests.
• Unexpected outbound queries from the application database user or anomalous read volumes against patient tables.

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting patients.php request parameters.
• Enable database query logging and alert on queries containing tautologies, stacked statements, or INFORMATION_SCHEMA access from the application account.
• Correlate authentication events with subsequent abnormal database access patterns to identify abuse by low-privileged users.

Monitoring Recommendations

• Monitor PHP application error logs for SQL syntax errors referencing the patient_name column or query.
• Track HTTP request rates and payload entropy targeting /patients.php from individual source IPs and authenticated sessions.
• Forward web, application, and database telemetry to a centralized analytics platform for cross-source correlation and retention.

How to Mitigate CVE-2024-7454

Immediate Actions Required

• Restrict network access to the Clinic's Patient Management System to trusted internal users via VPN or IP allowlisting.
• Audit application accounts and revoke unnecessary low-privilege accounts that could be abused to reach the vulnerable endpoint.
• Review database and web logs for historical exploitation attempts using the indicators listed above.
• Back up the patient database and verify integrity of existing records.

Patch Information

No vendor advisory or official patch has been published in the referenced sources at the time of writing. Organizations should consult the VulDB entry #273548 and the GitHub CVE Resource for ongoing updates. Until a fix is available, apply compensating controls and consider migrating to a supported electronic health record platform.

Workarounds

• Modify patients.php to use parameterized queries or PDO prepared statements when handling the patient_name input.
• Apply server-side input validation that rejects SQL metacharacters in the patient_name field.
• Deploy a WAF with signatures for SQL injection in front of the application and place the system behind authenticated reverse proxy access.
• Run the application database account with least-privilege permissions to limit the impact of successful injection.

# Example ModSecurity rule to block SQLi attempts against patients.php
SecRule REQUEST_URI "@contains /patients.php" \
    "phase:2,chain,deny,status:403,id:1007454,msg:'Possible SQLi in patient_name (CVE-2024-7454)'"
    SecRule ARGS:patient_name "@rx (?i)(union(\s)+select|--|;|/\*|or\s+1=1|information_schema)" "t:none"