CVE-2024-7750: Clinic's Patient Management System SQLi

CVE-2024-7750 Overview

CVE-2024-7750 is a SQL injection vulnerability in SourceCodester Clinic's Patient Management System version 1.0. The flaw resides in /medicines.php, where the medicine_name parameter is passed directly to a backend SQL query without proper sanitization [CWE-89]. Attackers can manipulate this parameter to alter query logic, extract database contents, or modify records. The vulnerability is remotely exploitable and requires only low-privilege authenticated access. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against internet-exposed installations.

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the medicine_name parameter in /medicines.php, exposing patient data stored in the clinic database.

Affected Products

SourceCodester Clinic's Patient Management System 1.0
Vendor: oretnom23
Component: /medicines.php (medicine_name parameter)

Discovery Timeline

2024-08-13 - CVE-2024-7750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7750

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw affecting the medicines management module of the application. When a user submits a request that includes the medicine_name argument, the value is concatenated into a SQL statement without parameterization or input validation. An attacker supplying crafted input can terminate the intended query and append arbitrary SQL clauses.

Exploitation can yield unauthorized read access to patient records, medicine inventory data, and administrative account credentials stored in the underlying MySQL database. Depending on database privileges, attackers may also write or delete records. Because the application is designed to hold protected health information, successful exploitation carries regulatory and privacy consequences beyond the raw technical impact.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The medicines.php endpoint accepts the medicine_name parameter and inserts it directly into a query string. The application does not use prepared statements, parameterized queries, or an input allow-list, allowing attacker-controlled SQL fragments to be executed by the database engine.

Attack Vector

The attack vector is network-based and requires low privileges on the target application. An attacker with a valid low-tier account submits a crafted request to /medicines.php with a malicious medicine_name value. No user interaction is required, and the exploit does not depend on chained vulnerabilities. Technical details are documented in the public proof-of-concept and the VulDB entry #274369.

Detection Methods for CVE-2024-7750

Indicators of Compromise

Web server access logs showing requests to /medicines.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( within the medicine_name parameter.
Database error messages returned to clients or logged by MySQL that reference syntax failures near the medicines query.
Unexpected outbound HTTP responses of anomalous size from /medicines.php, suggesting data exfiltration through UNION-based injection.

Detection Strategies

Deploy a web application firewall (WAF) rule to identify SQL injection payload patterns targeting the medicine_name parameter.
Enable MySQL general query logging on the clinic database and alert on queries containing tautologies such as OR 1=1 or stacked statements against the medicines table.
Correlate authentication events with subsequent access to /medicines.php to identify low-privilege accounts issuing atypical query volumes.

Monitoring Recommendations

Baseline normal request patterns to /medicines.php and alert on deviations in parameter length, character set, and request rate.
Monitor for repeated HTTP 500 responses from the endpoint, which frequently accompany SQL injection reconnaissance.
Track database user activity for unusual INFORMATION_SCHEMA queries originating from the web application service account.

How to Mitigate CVE-2024-7750

Immediate Actions Required

Restrict network access to the Clinic's Patient Management System until a fix is applied, allowing only trusted management networks.
Audit application accounts and disable any unused low-privilege users that could be leveraged to reach /medicines.php.
Deploy WAF signatures that block SQL injection payloads targeting the medicine_name parameter.

Patch Information

No vendor patch has been published for CVE-2024-7750 at the time of writing. Organizations running SourceCodester Clinic's Patient Management System 1.0 should treat the application as unsupported for production use with real patient data and evaluate migration to a maintained alternative. Monitor the VulDB advisory for updates.

Workarounds

Modify medicines.php to use parameterized queries or PDO prepared statements when handling the medicine_name argument.
Apply server-side input validation that restricts medicine_name to an allow-list of alphanumeric characters and expected punctuation.
Reduce the privileges of the database account used by the application to the minimum required for medicine record operations, preventing schema disclosure and data modification.

bash

# Example ModSecurity rule to block SQLi attempts against medicine_name
SecRule ARGS:medicine_name "@detectSQLi" \
    "id:1007750,phase:2,deny,status:403,\
    msg:'CVE-2024-7750 SQLi attempt against medicines.php',\
    logdata:'Matched Data: %{MATCHED_VAR}'"