CVE-2024-8564: PHP CRUD SQL Injection Vulnerability

CVE-2024-8564 Overview

CVE-2024-8564 is a SQL injection vulnerability in SourceCodester PHP CRUD 1.0. The flaw resides in the /endpoint/update.php script, where the tbl_person_id, first_name, middle_name, and last_name parameters are passed directly into a SQL statement without sanitization. Attackers can exploit the vulnerability remotely over the network with low-privileged access. The exploit has been disclosed publicly, increasing the risk of opportunistic use against exposed instances. The underlying weakness maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote attackers can inject arbitrary SQL statements through multiple parameters in update.php, exposing database contents and enabling unauthorized modification of stored records.

Affected Products

SourceCodester PHP CRUD 1.0
rems:php_crud component (CPE: cpe:2.3:a:rems:php_crud:1.0:*:*:*:*:*:*:*)
Deployments exposing /endpoint/update.php to untrusted networks

Discovery Timeline

2024-09-07 - CVE-2024-8564 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8564

Vulnerability Analysis

The vulnerability affects the update workflow in PHP CRUD 1.0. When a client submits a request to /endpoint/update.php, the application incorporates user-supplied values for tbl_person_id, first_name, middle_name, and last_name directly into a SQL query. No parameterization or input validation is applied before the query executes against the backend database.

Because the injection points appear in an update operation, an attacker can influence both the WHERE clause and the values being written. This enables data disclosure through blind or error-based techniques, tampering with existing records, and potentially chained attacks against the database engine.

The issue is exploitable remotely and requires only low-privileged authenticated access. Publicly available disclosure details reduce the barrier to weaponization for opportunistic attackers scanning for the affected endpoint.

Root Cause

The root cause is the concatenation of untrusted HTTP parameter values into a SQL statement without using prepared statements or bound parameters. The affected script does not enforce type constraints on tbl_person_id and does not escape string inputs before they reach the database driver.

Attack Vector

Exploitation occurs over the network by sending a crafted HTTP request to /endpoint/update.php. An attacker supplies SQL metacharacters within any of the four affected parameters to break out of the intended query context. Successful injection allows the attacker to append additional clauses, extract data using boolean or time-based techniques, or overwrite record fields with malicious content.

The vulnerability manifests in the parameter-handling logic of update.php. Refer to the VulDB Entry #276784 for parameter-level disclosure details.

Detection Methods for CVE-2024-8564

Indicators of Compromise

HTTP POST or GET requests to /endpoint/update.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the tbl_person_id, first_name, middle_name, or last_name parameters.
Unexpected database errors or elongated response times correlated with requests to the update endpoint.
Unauthorized modifications to tbl_person rows or the appearance of injected values in downstream views.

Detection Strategies

Deploy web application firewall signatures that inspect requests to /endpoint/update.php for SQL injection patterns in the four affected parameters.
Enable database query logging and alert on anomalous statements originating from the PHP CRUD application service account.
Correlate web server access logs with database audit logs to identify injected payloads that produced query errors or unusually large result sets.

Monitoring Recommendations

Baseline normal request patterns to /endpoint/update.php and alert on deviations in parameter length, character distribution, or request frequency.
Monitor for repeated 500-series responses from the endpoint, which often indicate SQL syntax errors during injection probing.
Track outbound database connections for exfiltration-sized responses that follow suspicious update requests.

How to Mitigate CVE-2024-8564

Immediate Actions Required

Restrict access to /endpoint/update.php to trusted networks or authenticated internal users only.
Deploy WAF rules that block SQL metacharacters in the tbl_person_id, first_name, middle_name, and last_name parameters until code fixes are applied.
Audit the tbl_person table for unauthorized modifications performed since the application was exposed.

Patch Information

No vendor-supplied patch is referenced in the enriched advisory data. Consult the VulDB CTI Index #276784 and the SourceCodester Resource Hub for updated releases. Organizations that maintain a local fork should replace concatenated SQL in update.php with parameterized queries using PDO or MySQLi prepared statements and enforce strict input validation on all four parameters.

Workarounds

Refactor the affected query in update.php to use prepared statements with bound parameters and cast tbl_person_id to an integer before use.
Apply server-side allow-list validation for name fields, rejecting characters outside expected Unicode letter ranges.
Run the database account used by PHP CRUD with least privilege, denying DROP, ALTER, and cross-schema access to limit blast radius.

bash

# Configuration example: temporary WAF rule (ModSecurity syntax)
SecRule REQUEST_URI "@streq /endpoint/update.php" \
  "id:1008564,phase:2,deny,status:403,\
   chain,msg:'CVE-2024-8564 SQLi attempt on PHP CRUD update.php'"
  SecRule ARGS:tbl_person_id|ARGS:first_name|ARGS:middle_name|ARGS:last_name \
    "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|#|';)"