CVE-2024-8346: Computer Laboratory Management System SQLi

CVE-2024-8346 Overview

CVE-2024-8346 is a SQL injection vulnerability in SourceCodester Computer Laboratory Management System 1.0, developed by oretnom23. The flaw exists in the update_settings_info function within /classes/SystemSettings.php?f=update_settings. Attackers can manipulate the name parameter to inject arbitrary SQL statements into backend database queries. Remote exploitation is possible without administrative access, and the exploit has been publicly disclosed. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated remote attackers can inject SQL commands through the name parameter, potentially exposing or modifying database contents in the laboratory management application.

Affected Products

• SourceCodester Computer Laboratory Management System 1.0
• oretnom23 Computer Laboratory Management System (PHP-based web application)
• /classes/SystemSettings.php settings update endpoint

Discovery Timeline

• 2024-08-30 - CVE-2024-8346 published to the National Vulnerability Database (NVD)
• 2024-09-04 - Last updated in NVD database

Technical Details for CVE-2024-8346

Vulnerability Analysis

The vulnerability resides in the update_settings_info function of the SystemSettings.php class file. When the application processes the update_settings action, user-supplied input from the name parameter is concatenated directly into a SQL statement without parameterization or sanitization. An attacker can submit crafted input through the HTTP request to alter query logic, extract data, or modify stored records.

The attack requires network access to the application and low-privilege authentication. No user interaction is required, and the exploit can be triggered remotely against any reachable instance of the application. A public proof-of-concept document is available on GitHub, lowering the barrier to exploitation.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The update_settings_info routine builds SQL queries using string concatenation with values pulled directly from the HTTP request. Without prepared statements or input validation, characters such as single quotes, semicolons, and SQL keywords are interpreted as syntax rather than data.

Attack Vector

An attacker sends an HTTP request to /classes/SystemSettings.php?f=update_settings with a malicious payload in the name POST field. By including SQL meta-characters and clauses (for example, UNION SELECT statements or boolean-based blind injection patterns), the attacker manipulates the query executed against the underlying MySQL database. Successful exploitation allows data exfiltration, authentication record tampering, or modification of application configuration stored in the database.

A technical proof-of-concept is documented in the GitHub PoC Document and indexed by VulDB #276228.

Detection Methods for CVE-2024-8346

Indicators of Compromise

• POST requests to /classes/SystemSettings.php?f=update_settings containing SQL meta-characters such as ', --, UNION, SELECT, or SLEEP( in the name parameter.
• Unexpected database error messages, slow query log entries, or anomalous response sizes correlating with settings update requests.
• Web server access logs showing repeated requests to the SystemSettings endpoint from a single source within short time windows.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL keywords and tautologies in POST parameters targeting /classes/SystemSettings.php.
• Enable database query logging and alert on queries containing concatenated user input or unusual UNION and INFORMATION_SCHEMA references.
• Correlate authentication events with subsequent settings update requests to identify low-privilege accounts probing administrative endpoints.

Monitoring Recommendations

• Forward web server, application, and MySQL logs to a centralized SIEM for cross-source correlation and retention.
• Monitor for outbound data transfer spikes from the database host that may indicate exfiltration following injection.
• Establish baseline request patterns for the SystemSettings endpoint and alert on deviations in volume or payload entropy.

How to Mitigate CVE-2024-8346

Immediate Actions Required

• Restrict access to the Computer Laboratory Management System using network segmentation, VPN, or IP allow-listing until a fix is applied.
• Audit application accounts and disable or rotate credentials for any low-privilege users that no longer require access.
• Review database logs for evidence of prior exploitation against the settings update endpoint.

Patch Information

No official vendor patch is listed in the NVD record for CVE-2024-8346. Operators of SourceCodester Computer Laboratory Management System 1.0 should monitor the SourceCodester Security Resource for updated releases. In the absence of an upstream fix, administrators must apply source-level remediation by replacing string concatenation in update_settings_info with parameterized queries (PDO prepared statements or mysqli_stmt_bind_param).

Workarounds

• Modify /classes/SystemSettings.php to validate the name parameter against an allow-list of expected characters before reaching SQL logic.
• Place the application behind a WAF configured with OWASP Core Rule Set signatures targeting SQL injection in POST bodies.
• Apply least-privilege principles to the database user account so that the application connection cannot read system tables or modify schema.

# Example: enable MySQL general query logging to capture injection attempts
mysql -u root -p -e "SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/log/mysql/queries.log';"

# Example: restrict access to the application endpoint with nginx
location /classes/SystemSettings.php {
    allow 10.0.0.0/8;
    deny all;
}