CVE-2024-7754: Clinic's Patient Management SQL Injection

CVE-2024-7754 Overview

CVE-2024-7754 is a SQL injection vulnerability in SourceCodester Clinic's Patient Management System version 1.0. The flaw resides in the /ajax/check_medicine_name.php endpoint, where the user_name parameter is passed to a database query without sanitization. Remote attackers with low privileges can inject arbitrary SQL statements through this parameter. Public exploit documentation has been disclosed, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can extract, modify, or delete data from the backend database by injecting SQL through the user_name parameter of check_medicine_name.php.

Affected Products

SourceCodester (oretnom23) Clinic's Patient Management System 1.0
Deployments exposing /ajax/check_medicine_name.php
Downstream forks that reuse the vulnerable AJAX handler

Discovery Timeline

2024-08-14 - CVE-2024-7754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7754

Vulnerability Analysis

The vulnerability affects the AJAX endpoint /ajax/check_medicine_name.php, which validates medicine name uniqueness during patient record management. The handler concatenates the user_name request parameter directly into a SQL query string. Attackers can break out of the intended string context and append arbitrary SQL clauses.

Exploitation requires network access to the application and a low-privileged authenticated session. No user interaction is needed. Successful injection allows attackers to enumerate database schemas, exfiltrate patient records, or manipulate stored medical data.

Because the application manages clinical information, exploitation impacts confidentiality and integrity of protected health data. Public proof-of-concept documentation lowers the barrier for opportunistic attackers scanning for the endpoint. Refer to the GitHub exploit documentation and VulDB entry #274373 for additional context.

Root Cause

The root cause is missing input validation and lack of parameterized queries [CWE-89]. The user_name argument passes through the PHP handler and is embedded directly into a MySQL query without prepared statements, escaping, or type coercion.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to /ajax/check_medicine_name.php containing SQL metacharacters in the user_name parameter. The backend executes the resulting statement against the clinic database, returning attacker-controlled query results.

No verified exploit code is reproduced here. See the linked GitHub write-up for public proof-of-concept details.

Detection Methods for CVE-2024-7754

Indicators of Compromise

HTTP POST or GET requests to /ajax/check_medicine_name.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- in the user_name parameter.
Unexpected database error responses returned from the medicine name check endpoint.
Abnormal query latency on the backend MySQL server correlated with requests to the vulnerable AJAX handler.

Detection Strategies

Deploy web application firewall rules that inspect the user_name parameter of /ajax/check_medicine_name.php for SQL injection payloads.
Enable database query logging and alert on statements that reference information_schema from the clinic application user.
Correlate authentication logs with anomalous request patterns from a single session hitting the AJAX handler repeatedly.

Monitoring Recommendations

Monitor web server access logs for high-frequency requests to check_medicine_name.php from a single source IP.
Alert on outbound data volume spikes from the database host that may indicate bulk record exfiltration.
Track authenticated user sessions that generate malformed SQL errors in application logs.

How to Mitigate CVE-2024-7754

Immediate Actions Required

Restrict network access to the Clinic's Patient Management System to trusted internal networks or a VPN.
Audit the check_medicine_name.php handler and rewrite the query using prepared statements with bound parameters.
Rotate database credentials used by the application and review recent database activity for signs of prior exploitation.

Patch Information

No vendor patch has been published in the referenced advisories. Because SourceCodester Clinic's Patient Management System 1.0 does not have an official fix listed in the NVD entry, operators must apply source-level remediation. Replace string concatenation in the affected PHP file with PDO::prepare and parameter binding, and validate that user_name matches an expected character set.

Workarounds

Place the application behind a web application firewall with SQL injection signatures enabled for the affected endpoint.
Remove or disable the check_medicine_name.php handler if the AJAX medicine name check is not required.
Enforce least-privilege database accounts so the application user cannot access information_schema or execute administrative statements.

bash

# Example ModSecurity rule blocking SQLi payloads in the user_name parameter
SecRule REQUEST_URI "@contains /ajax/check_medicine_name.php" \
    "phase:2,chain,deny,status:403,id:1007754,\
     msg:'CVE-2024-7754 SQLi attempt on check_medicine_name.php'"
    SecRule ARGS:user_name "@detectSQLi" "t:none"