CVE-2024-8561: Rems PHP CRUD SQL Injection Vulnerability

CVE-2024-8561 Overview

CVE-2024-8561 is a SQL injection vulnerability in SourceCodester PHP CRUD 1.0. The flaw resides in the /endpoint/delete.php file, which implements the Delete Person Handler component. Attackers can manipulate the person parameter to inject arbitrary SQL statements into the underlying database query. The vulnerability is exploitable remotely over the network and requires low privileges. The issue maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote attackers with low privileges can inject arbitrary SQL into the Delete Person Handler, allowing unauthorized read, modification, or deletion of database records.

Affected Products

• SourceCodester PHP CRUD 1.0
• Rems PHP CRUD 1.0 (cpe:2.3:a:rems:php_crud:1.0)
• Delete Person Handler component (/endpoint/delete.php)

Discovery Timeline

• 2024-09-07 - CVE-2024-8561 published to the National Vulnerability Database
• 2024-09-10 - Last updated in NVD database

Technical Details for CVE-2024-8561

Vulnerability Analysis

The vulnerability exists in the Delete Person Handler implemented in /endpoint/delete.php. The endpoint accepts a person parameter and incorporates the value directly into a SQL DELETE statement without parameterization or input sanitization. An attacker can supply crafted SQL syntax in the person argument to alter the query's intended logic.

Exploitation requires network access and a low-privilege session but no user interaction. Successful injection allows attackers to enumerate database contents, modify rows, delete unrelated records, or escalate access depending on database permissions. The CWE-89 classification reflects the lack of neutralization of special characters before the input reaches the SQL interpreter.

Root Cause

The root cause is the direct concatenation of untrusted request data into a SQL query string. The application does not use prepared statements or bind parameters when constructing the DELETE query in /endpoint/delete.php. Any metacharacters such as single quotes, semicolons, or SQL keywords supplied through the person parameter become part of the executed statement.

Attack Vector

An attacker sends an HTTP request to /endpoint/delete.php containing a malicious payload in the person parameter. The payload extends the original DELETE query with attacker-controlled SQL such as boolean conditions, UNION SELECT clauses, or stacked statements where supported by the database driver. The attack can be launched remotely against any exposed instance of PHP CRUD 1.0.

The vulnerability does not require authentication bypass or social engineering. Public proof-of-concept disclosure through VulDB makes reproduction straightforward. See the VulDB entry #276781 for additional technical context.

Detection Methods for CVE-2024-8561

Indicators of Compromise

• HTTP requests to /endpoint/delete.php containing SQL metacharacters in the person parameter, such as single quotes, --, ;, or UNION.
• Web server access logs showing repeated requests to the delete endpoint with varying person values indicative of injection probing.
• Unexpected DELETE, SELECT, or UNION queries in database logs originating from the PHP CRUD application user.
• Unexplained removal or modification of rows in tables referenced by the Delete Person Handler.

Detection Strategies

• Inspect web application firewall (WAF) and reverse proxy logs for SQL injection signatures targeting the person parameter.
• Enable database query logging and alert on multi-statement queries or syntactically anomalous DELETE operations from the application service account.
• Apply static analysis to the PHP source to flag string concatenation between request data and SQL strings in /endpoint/delete.php.

Monitoring Recommendations

• Forward web server, WAF, and database audit logs to a centralized analytics platform for correlation across request and query layers.
• Build alerts for anomalous response sizes or HTTP 500 errors returned by /endpoint/delete.php, which often indicate injection attempts.
• Track outbound database connections from the PHP CRUD host to identify data exfiltration following successful injection.

How to Mitigate CVE-2024-8561

Immediate Actions Required

• Restrict network exposure of PHP CRUD 1.0 instances to trusted internal networks or place them behind authenticated reverse proxies.
• Deploy WAF rules that block SQL injection patterns targeting the person parameter on /endpoint/delete.php.
• Rotate database credentials used by the application and confirm the account holds only the minimum privileges required.
• Audit database tables touched by the Delete Person Handler for unauthorized modifications.

Patch Information

No vendor patch is listed in the referenced advisories at the time of NVD publication. SourceCodester PHP CRUD 1.0 is a small open-source project, and remediation requires code-level changes by the operator. Replace the vulnerable query construction in /endpoint/delete.php with prepared statements using PDO or MySQLi parameter binding. Validate that the person parameter is a numeric identifier before passing it to the database layer. Consult SourceCodester and the VulDB CTI #276781 entry for ongoing remediation tracking.

Workarounds

• Modify /endpoint/delete.php to enforce strict input validation, accepting only integer values for the person argument.
• Replace inline SQL string concatenation with parameterized queries using PDO::prepare() and bindParam().
• Apply least-privilege principles to the database account so it cannot execute DROP, ALTER, or cross-table SELECT operations.
• If patching is not feasible, take the application offline until the Delete Person Handler is refactored.

# Configuration example: minimal ModSecurity rule to block SQL metacharacters in the person parameter
SecRule ARGS:person "@rx (?i)(\bunion\b|\bselect\b|--|;|'|\")" \
    "id:1008561,phase:2,deny,status:403,msg:'CVE-2024-8561 SQLi attempt on person parameter'"