CVE-2024-7794: Vehicle Management System SQL Injection

CVE-2024-7794 Overview

CVE-2024-7794 is a SQL injection vulnerability in itsourcecode Vehicle Management System 1.0. The flaw resides in the mybill.php script, where the id parameter is passed to a database query without proper sanitization. A remote attacker with low-level privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed deployments. The weakness is tracked as [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers can execute arbitrary SQL queries through the id parameter in mybill.php, potentially exposing or modifying billing and vehicle records stored in the backend database.

Affected Products

• Admerc Vehicle Management System 1.0
• mybill.php component (vulnerable endpoint)
• Deployments referenced by CPE cpe:2.3:a:admerc:vehicle_management_system:1.0

Discovery Timeline

• 2024-08-14 - CVE-2024-7794 published to NVD
• 2025-12-19 - Last updated in NVD database

Technical Details for CVE-2024-7794

Vulnerability Analysis

The vulnerability exists in mybill.php, a PHP script used to retrieve billing records by identifier. The script accepts the id parameter from an HTTP request and concatenates it directly into a SQL query without parameterization or input validation. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Because the attack vector is network-based and requires only low privileges, an authenticated user of the application can issue malicious requests to enumerate database contents. Public disclosure of the exploit details lowers the barrier to abuse. The EPSS probability is currently 0.125%, but public exploit availability typically drives opportunistic scanning against indexed PHP endpoints.

Root Cause

The root cause is improper neutralization of user-supplied input passed to the SQL engine. The id parameter is interpolated into a query string rather than bound as a prepared statement parameter. No allow-list or type-cast (such as casting id to an integer) is applied before query construction.

Attack Vector

An attacker submits a crafted HTTP request to mybill.php with a malicious id value. Typical payloads use a UNION SELECT clause or boolean-based conditions to exfiltrate column data from the application database. Successful exploitation can disclose credentials, billing records, and other sensitive fields stored in the schema. See the GitHub Issue Discussion for the original public proof of concept.

Detection Methods for CVE-2024-7794

Indicators of Compromise

• HTTP requests to mybill.php containing SQL meta-characters such as ', --, UNION, SELECT, or SLEEP( in the id query string parameter
• Web server access logs showing repeated requests to mybill.php?id= with abnormally long or encoded values
• Unexpected database errors or 500 responses returned from mybill.php correlated to crafted id values

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the id parameter of mybill.php
• Enable database query logging and alert on queries containing tautologies (e.g., OR 1=1) or stacked statements originating from the application user
• Correlate web access logs with database audit logs to identify suspicious query patterns triggered by individual sessions

Monitoring Recommendations

• Monitor outbound traffic from the application server for unusual data volumes that may indicate database exfiltration
• Track authentication anomalies that may follow credential theft from a compromised database
• Review application logs daily for repeated 4xx and 5xx responses on mybill.php endpoints

How to Mitigate CVE-2024-7794

Immediate Actions Required

• Restrict network access to the Vehicle Management System to trusted users and internal networks only
• Apply a WAF rule blocking SQL meta-characters in the id parameter of mybill.php
• Audit the application database for unauthorized read or modification activity since the publication date
• Rotate database credentials and any application secrets that may have been exposed

Patch Information

No vendor patch is referenced in the available advisories. Operators should monitor the VulDB entry #274562 and the GitHub Issue Discussion for vendor updates. In the absence of an official fix, modify mybill.php to use prepared statements with bound parameters and cast id to an integer before query construction.

Workarounds

• Implement prepared statements or parameterized queries for all database access in mybill.php
• Cast the id parameter to an integer using intval() before passing it into any SQL statement
• Apply least-privilege database accounts that prevent the application user from reading sensitive tables or executing administrative commands
• Temporarily disable the mybill.php endpoint if it is not required for business operations

# Example WAF rule (ModSecurity) to block SQLi in the id parameter
SecRule ARGS:id "@detectSQLi" \
    "id:1007794,phase:2,deny,status:403,\
    msg:'CVE-2024-7794 SQLi attempt on mybill.php',\
    logdata:'Matched data: %{MATCHED_VAR}'"