CVE-2024-7930: Clinic's Patient Management System SQLi

CVE-2024-7930 Overview

CVE-2024-7930 is a SQL injection vulnerability in SourceCodester Clinic's Patient Management System 1.0. The flaw resides in the /pms/ajax/get_packings.php endpoint, where the medicine_id parameter is passed to a database query without proper sanitization. Attackers can inject arbitrary SQL statements remotely over the network with only low-privileged access. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote authenticated attackers can extract, modify, or delete sensitive patient and clinical data through SQL injection in the medicine_id parameter.

Affected Products

Oretnom23 (SourceCodester) Clinic's Patient Management System 1.0
The /pms/ajax/get_packings.php endpoint
Deployments exposing the application to untrusted networks

Discovery Timeline

2024-08-19 - CVE-2024-7930 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7930

Vulnerability Analysis

The vulnerability exists in the AJAX handler /pms/ajax/get_packings.php, which retrieves medicine packing information based on a client-supplied identifier. The medicine_id request parameter is concatenated directly into an SQL query string. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses. Because the endpoint accepts network requests, exploitation requires no local access. An attacker with a low-privileged application account can trigger the flaw, and public disclosure of the exploit lowers the technical barrier to use it.

Root Cause

The root cause is a failure to use parameterized queries or prepared statements when processing the medicine_id input. Input validation and type coercion are absent, so string values are interpolated into the SQL statement verbatim. The application also lacks a defense-in-depth layer such as query allow-listing or an ORM.

Attack Vector

An attacker sends a crafted HTTP request to /pms/ajax/get_packings.php with a malicious medicine_id value. Payloads can use UNION-based, error-based, boolean-based, or time-based blind techniques to enumerate database contents. Successful exploitation can expose patient records, medical history, medication data, and application credentials. Depending on database privileges, attackers may also write files or execute commands through database-native functions.

No verified public exploit code is referenced in the enriched data. Technical write-ups and references are available in the GitHub CVE SQL Overview and VulDB entry #275116.

Detection Methods for CVE-2024-7930

Indicators of Compromise

HTTP requests to /pms/ajax/get_packings.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA in the medicine_id parameter.
Web server logs showing repeated requests to the endpoint with abnormally long or encoded parameter values.
Database error messages or unusually slow responses tied to requests against the packings endpoint.
Unexpected read operations against sensitive tables such as users, patients, or medicines shortly after requests to the endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection payload patterns targeting the medicine_id parameter.
Enable database query logging and alert on queries against the packings table containing UNION clauses or comment markers.
Correlate authenticated user sessions with volumetric or anomalous requests to /pms/ajax/get_packings.php.

Monitoring Recommendations

Monitor authentication logs for low-privileged accounts issuing large numbers of AJAX requests to the PMS backend.
Alert on outbound traffic from the database host that could indicate exfiltration following successful injection.
Track file-integrity changes on the web root and database configuration to catch post-exploitation persistence.

How to Mitigate CVE-2024-7930

Immediate Actions Required

Restrict network access to the Clinic's Patient Management System to trusted internal ranges or a VPN until a patch is available.
Disable or block the /pms/ajax/get_packings.php endpoint if it is not required for current operations.
Rotate application, database, and session credentials that may have been exposed through the vulnerable endpoint.
Review recent web and database logs for evidence of exploitation and initiate incident response if indicators are present.

Patch Information

No official vendor advisory or patch is listed in the enriched CVE data. Administrators should monitor the SourceCodester project page and the VulDB entry #275116 for updates. Until an upstream fix is released, apply source-level remediation by replacing string concatenation in get_packings.php with parameterized queries and enforcing integer type validation on medicine_id.

Workarounds

Place a WAF or reverse proxy in front of the application and block requests where medicine_id is not a positive integer.
Enforce least-privilege on the database account used by the application, removing FILE, CREATE, and DROP privileges.
Apply virtual patching to reject SQL metacharacters in query and body parameters until code-level fixes are deployed.

bash

# Example nginx rule to enforce numeric medicine_id values
location = /pms/ajax/get_packings.php {
    if ($arg_medicine_id !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://pms_backend;
}