CVE-2024-8080: Online Health Care System SQLi Vulnerability

CVE-2024-8080 Overview

CVE-2024-8080 is a SQL injection vulnerability in SourceCodester Online Health Care System 1.0. The flaw resides in the search.php script, where the f_name parameter is concatenated into a SQL statement without proper sanitization. Attackers can manipulate the parameter using UNION-based payloads to extract data directly from the backing database. The vulnerability is remotely exploitable over the network and requires only low-privileged access. Public disclosure of the exploit technique increases the likelihood of opportunistic attacks against exposed installations. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers can inject arbitrary SQL through the f_name parameter in search.php, enabling unauthorized read access to database contents including patient and credential records.

Affected Products

• SourceCodester Online Health Care System 1.0
• cpe:2.3:a:online_health_care_system_project:online_health_care_system:1.0
• Deployments using the unpatched search.php endpoint

Discovery Timeline

• 2024-08-22 - CVE-2024-8080 published to the National Vulnerability Database (NVD)
• 2024-10-17 - Last updated in NVD database

Technical Details for CVE-2024-8080

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in the search functionality of the Online Health Care System web application. The search.php endpoint accepts a f_name HTTP parameter and embeds the value directly into a SQL query string. Because the application does not use parameterized queries or input validation, an attacker can break out of the original query context and append arbitrary SQL clauses.

The published proof-of-concept payload uses a UNION SELECT statement combined with the database() function to enumerate metadata from the underlying database. Using 23 columns matching the original query's column count, the payload returns attacker-controlled values in the application response. This pattern allows extraction of schema names, table contents, and credential material stored in the application's database.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL command construction [CWE-89]. The application concatenates the f_name query parameter into a SQL statement using string interpolation instead of prepared statements with bound parameters. There is no allowlist filtering, type validation, or escaping applied before the value reaches the database driver.

Attack Vector

Exploitation requires network access to the application and a valid low-privileged session capable of reaching search.php. An attacker submits a crafted f_name value such as 1%' or 1=1 ) UNION SELECT 1,2,3,4,5,database(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# to terminate the original predicate and append a UNION query. The server returns the merged result set, exposing database internals through the search response page.

No verified code examples are available for CVE-2024-8080. Refer to the GitHub SQL Injection Guide and VulDB entry #275562 for technical details on the payload structure.

Detection Methods for CVE-2024-8080

Indicators of Compromise

• HTTP GET or POST requests to search.php containing SQL keywords such as UNION SELECT, database(), or information_schema in the f_name parameter.
• Web server access logs showing URL-encoded single quotes (%27), comment markers (#, --), or stacked parentheses in the f_name value.
• Anomalous response sizes from search.php indicating returned rows from UNION-based extraction.
• Database query logs showing UNION statements originating from the application's database user account.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL meta-characters and UNION-based payloads targeting the search.php endpoint.
• Enable database query auditing to capture statements containing UNION SELECT issued by the application service account.
• Correlate web access logs with database telemetry to identify input-to-query mappings consistent with injection attempts.

Monitoring Recommendations

• Monitor outbound HTTP responses from search.php for unusual payload sizes or schema names appearing in rendered output.
• Alert on repeated 200 OK responses to search.php requests containing SQL grammar tokens within f_name.
• Track authentication anomalies that may follow successful credential extraction from the database.

How to Mitigate CVE-2024-8080

Immediate Actions Required

• Restrict network access to the Online Health Care System application to trusted internal networks until a fix is applied.
• Place a WAF in front of the application with rules blocking SQL injection patterns targeting f_name and other search parameters.
• Audit database logs for evidence of prior UNION-based extraction and rotate any credentials stored in the application database.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-8080. SourceCodester project maintainers have not published a fixed release. Operators should apply code-level remediation by rewriting the search.php query to use parameterized statements with bound parameters and validate that f_name accepts only expected character classes.

Workarounds

• Replace string-concatenated SQL in search.php with prepared statements using PDO or MySQLi bound parameters.
• Apply server-side input validation that rejects non-alphanumeric characters in the f_name field.
• Run the application database account with least-privilege access, removing rights to system tables such as information_schema where feasible.
• Disable detailed SQL error reporting in the production application to reduce information available to attackers.

# Example WAF rule (ModSecurity) to block SQL injection in f_name
SecRule ARGS:f_name "@rx (?i:(union(\s|\+)+select|database\(\)|information_schema|--|#))" \
    "id:1008080,phase:2,deny,status:403,msg:'CVE-2024-8080 SQLi attempt in f_name'"