CVE-2024-8559: Online Food Menu SQL Injection Vulnerability

CVE-2024-8559 Overview

CVE-2024-8559 is a SQL injection vulnerability in SourceCodester Online Food Menu 1.0, developed by remyandrade. The flaw affects the /endpoint/delete-menu.php file, where the menu parameter is passed to a database query without proper sanitization. Attackers with authenticated access can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed installations. This weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
A remote authenticated attacker can inject SQL commands through the menu parameter of delete-menu.php, enabling unauthorized read, modification, or deletion of database records.

Affected Products

SourceCodester Online Food Menu 1.0
remyandrade Online Food Menu (cpe:2.3:a:remyandrade:online_food_menu:1.0)
Deployments referencing the vulnerable /endpoint/delete-menu.php endpoint

Discovery Timeline

2024-09-07 - CVE-2024-8559 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8559

Vulnerability Analysis

The vulnerability resides in the delete-menu handler of the Online Food Menu web application. The script accepts a menu argument and concatenates it directly into a SQL DELETE statement executed against the backend database. Because the input is neither parameterized nor escaped, attackers can append additional SQL syntax to alter query logic.

Successful exploitation permits data exfiltration, tampering with menu records, or destructive operations against other tables reachable through the same database user. The endpoint requires authenticated access, which limits opportunistic exploitation but does not prevent abuse by low-privileged users or attackers who obtain credentials through phishing or reuse.

Because the exploit has been published, defenders should treat internet-facing instances as high risk. The application is a small PHP project intended for learning purposes and is unlikely to receive a vendor patch.

Root Cause

The root cause is the absence of prepared statements or input validation in /endpoint/delete-menu.php. User-controlled data from the menu parameter is interpolated directly into a SQL string, violating standard secure coding practices for database access in PHP.

Attack Vector

Exploitation requires network access to the web application and valid credentials to reach the vulnerable endpoint. An attacker submits a crafted HTTP request in which the menu parameter contains SQL syntax such as boolean expressions, UNION selects, or stacked queries. See the VulDB entry #276779 for public disclosure details.

// Vulnerable request pattern (illustrative)
POST /endpoint/delete-menu.php
menu=<injected SQL payload>

Detection Methods for CVE-2024-8559

Indicators of Compromise

HTTP requests to /endpoint/delete-menu.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the menu parameter
Unexpected DELETE, UPDATE, or SELECT statements in MySQL query logs originating from the web application user
Sudden loss or modification of records in the menu table or related tables

Detection Strategies

Deploy web application firewall rules that inspect the menu parameter for SQL injection patterns and block or alert on matches
Enable database query logging and alert on anomalous statements issued by the Online Food Menu application account
Correlate authentication logs with subsequent requests to delete-menu.php to identify credential abuse

Monitoring Recommendations

Monitor web server access logs for repeated requests to /endpoint/delete-menu.php with encoded payloads or unusually long parameter values
Track error responses from the application that reveal SQL exceptions, which often indicate injection probing
Review privileged database actions during off-hours for signs of automated exploitation

How to Mitigate CVE-2024-8559

Immediate Actions Required

Restrict network access to the Online Food Menu application to trusted users or internal networks until remediation is complete
Rotate database and application credentials if the system was exposed to the internet before mitigation
Audit the menu and related tables for unauthorized modifications or deletions

Patch Information

No official vendor patch is listed for CVE-2024-8559. SourceCodester distributes Online Food Menu 1.0 as sample code through the SourceCodester Resource Hub. Administrators must apply source-level fixes by replacing string concatenation in /endpoint/delete-menu.php with parameterized queries using mysqli prepared statements or PDO with bound parameters. Refer to the VulDB CTI record #276779 for additional technical context.

Workarounds

Place the application behind a web application firewall with SQL injection signatures enabled
Enforce least-privilege database accounts so the application user cannot access tables outside its scope
Add server-side input validation to reject non-numeric values for the menu identifier before it reaches the database layer
Consider retiring the application in favor of a maintained menu management platform if used in production

bash

# Example: restrict database privileges for the application account
mysql -u root -p -e "REVOKE ALL PRIVILEGES ON *.* FROM 'foodmenu'@'%'; \
  GRANT SELECT, INSERT, UPDATE, DELETE ON online_food_menu.* TO 'foodmenu'@'%'; \
  FLUSH PRIVILEGES;"