CVE-2024-8173: Blood Bank System SQL Injection Vulnerability

CVE-2024-8173 Overview

CVE-2024-8173 is a SQL injection vulnerability in code-projects Blood Bank System 1.0. The flaw resides in the /login.php file, where the user parameter is passed unsanitized into a backend SQL query. Attackers can manipulate this argument remotely, without authentication, to inject arbitrary SQL statements. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Public disclosure of the exploit details has occurred, increasing the risk of opportunistic exploitation against exposed instances.

Critical Impact
Unauthenticated remote attackers can inject SQL through the login form, potentially exposing donor records, credentials, and other sensitive blood bank data.

Affected Products

code-projects Blood Bank System 1.0
Component: Login Page (/login.php)
Parameter: user

Discovery Timeline

2024-08-26 - CVE-2024-8173 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8173

Vulnerability Analysis

The vulnerability exists in the authentication flow of the Blood Bank System web application. The /login.php endpoint accepts a user parameter from the client and incorporates the value directly into an SQL query string. Because no parameterized queries, prepared statements, or input sanitization are applied, attacker-controlled input alters the syntax and semantics of the executing SQL statement.

The attack is remotely exploitable over the network and requires no privileges or user interaction. Successful injection enables authentication bypass, unauthorized data retrieval, and potential modification of database contents. The EPSS probability for this CVE is 0.668%.

Root Cause

The root cause is improper neutralization of user-supplied input before its inclusion in a SQL query. The login handler concatenates the user parameter into the query without binding it as a parameter or escaping special characters such as single quotes, comments, and boolean operators. This pattern allows attackers to break out of the intended query context.

Attack Vector

An attacker sends a crafted HTTP POST request to /login.php with a malicious payload in the user field. Typical SQL injection payloads abuse tautologies (for example, appending OR 1=1 style logic) or use UNION SELECT to extract data from other tables. Because the endpoint is the public login page, no prior session or credential is required to reach the vulnerable code path.

The vulnerability is documented in a public GitHub CVE description and tracked as VulDB #275772. See the Code Projects Resource for the affected application source.

Detection Methods for CVE-2024-8173

Indicators of Compromise

HTTP POST requests to /login.php containing SQL metacharacters such as ', --, #, UNION, SELECT, OR 1=1, or SLEEP( in the user parameter.
Web server access logs showing repeated failed logins from a single IP followed by anomalously long request bodies or query strings.
Database error messages returned to clients referencing MySQL syntax errors originating from the login endpoint.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects POST bodies submitted to /login.php for SQL injection signatures.
Enable database query logging and alert on queries originating from the login handler that contain UNION, multiple statements, or unusual comment sequences.
Correlate authentication failure spikes with abnormal request payload sizes on the login endpoint.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform and alert on SQL injection signatures targeting authentication endpoints.
Monitor outbound database connections for unusual SELECT volumes against tables containing donor or user data.
Track new accounts, password resets, and privilege changes that occur shortly after suspicious login traffic.

How to Mitigate CVE-2024-8173

Immediate Actions Required

Restrict network exposure of the Blood Bank System 1.0 application until a fix is applied; place the application behind a VPN or IP allow-list.
Deploy WAF rules to block SQL injection payloads targeting the user parameter on /login.php.
Audit the application database for unauthorized access, modified records, and rogue accounts.

Patch Information

No official vendor patch is listed in the advisory references for code-projects Blood Bank System 1.0. Organizations using this application should evaluate replacing it with a maintained alternative, or modify the source code to use parameterized queries (mysqli_prepare with bound parameters or PDO prepared statements) and apply server-side input validation on all login fields.

Workarounds

Rewrite the /login.php query to use prepared statements with bound parameters, eliminating string concatenation of user input.
Apply input validation that restricts the user field to an allowed character set (for example, alphanumerics and a limited set of symbols).
Run the database account used by the application with least privilege, denying schema and write access where not required.
Disable verbose database error messages returned to web clients to prevent information leakage that aids injection tuning.

bash

# Example WAF rule fragment (ModSecurity) to block SQLi on the login parameter
SecRule REQUEST_URI "@streq /login.php" \
  "phase:2,chain,deny,status:403,id:1008173,msg:'Possible SQLi on Blood Bank login'"
  SecRule ARGS:user "@rx (?i)(\bunion\b.*\bselect\b|--|\bor\b\s+1=1|sleep\s*\()" "t:none"