CVE-2024-8709: Best House Rental Management SQL Injection

CVE-2024-8709 Overview

CVE-2024-8709 is a SQL injection vulnerability in SourceCodester Best House Rental Management System 1.0, developed by Mayurik. The flaw resides in the delete_user and save_user functions within /admin_class.php. Attackers can manipulate the id parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network and requires low-privilege authentication. Public exploit details have been disclosed, increasing exposure risk for deployed instances. The weakness is tracked under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can inject SQL commands through the id parameter of admin_class.php, potentially reading, modifying, or deleting records in the rental management database.

Affected Products

Mayurik Best House Rental Management System 1.0
Product component: admin_class.php — delete_user function
Product component: admin_class.php — save_user function

Discovery Timeline

2024-09-12 - CVE-2024-8709 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8709

Vulnerability Analysis

The vulnerability affects the administrative user-management logic of Best House Rental Management System 1.0. Both the delete_user and save_user functions in /admin_class.php accept an id parameter supplied by the client. The application concatenates this value directly into SQL statements without parameterization or sanitization. An authenticated attacker can therefore break out of the intended SQL context and append arbitrary clauses to the query. Public disclosure of the exploit lowers the barrier to weaponization. The EPSS score is 0.601% with a percentile of 45.953, indicating a modest but measurable probability of exploitation activity.

Root Cause

The root cause is missing input validation and the absence of prepared statements around database calls that consume the id parameter. User-supplied data flows unchanged from the HTTP request into the SQL query string. This pattern is characteristic of CWE-89 and reflects insecure PHP database access practices common in legacy PHP/MySQL applications.

Attack Vector

Exploitation requires network access to the admin interface and valid low-privilege credentials. An attacker submits a crafted id value to endpoints that reach delete_user or save_user. The injected payload executes in the database context, enabling data extraction with UNION-based queries, boolean or time-based blind techniques, or record tampering. See the public write-up and VulDB entry #277218 for reproduction details.

No verified proof-of-concept code has been validated for inclusion. Refer to the GitHub Resource Document for the disclosed technical steps.

Detection Methods for CVE-2024-8709

Indicators of Compromise

Web server access logs containing SQL metacharacters (', --, UNION, SLEEP(, SELECT) in the id parameter of requests to admin_class.php.
Database error responses returned to authenticated admin sessions performing user create, edit, or delete actions.
Unexpected changes, additions, or removals in the users table without corresponding legitimate admin activity.

Detection Strategies

Deploy web application firewall rules that inspect POST and GET parameters targeting admin_class.php for SQL injection signatures.
Enable MySQL general query logging and alert on queries against the users table that include tautologies such as OR 1=1 or stacked statements.
Correlate authenticated admin session activity with database write volume to surface anomalous bulk changes.

Monitoring Recommendations

Baseline normal admin traffic to admin_class.php and alert on deviations in request rate or parameter length.
Monitor for outbound data transfers from the database host that could indicate exfiltration following successful injection.
Track failed admin login attempts preceding suspicious id parameter submissions to identify credential-stuffing precursors.

How to Mitigate CVE-2024-8709

Immediate Actions Required

Restrict access to the admin interface to trusted IP ranges or a VPN until a fix is applied.
Enforce strong, unique credentials on all administrator accounts and rotate any credentials that may have been exposed.
Review database audit logs for evidence of unauthorized queries against the users table.

Patch Information

No vendor patch has been published for Best House Rental Management System 1.0 at the time of writing. Consult the Source Codester project page and the VulDB advisory for status updates. Operators should apply source-level fixes by converting affected queries in admin_class.php to parameterized statements using PDO or mysqli prepared statements.

Workarounds

Modify delete_user and save_user in /admin_class.php to bind the id parameter using prepared statements instead of string concatenation.
Add server-side validation that rejects any id value that is not a positive integer before it reaches database logic.
Deploy a web application firewall with SQL injection rulesets in front of the application to filter malicious payloads targeting the admin endpoints.

bash

# Example server-side validation snippet to enforce integer id values
# Add to admin_class.php before any query using $_POST['id'] or $_GET['id']
if (!isset($_REQUEST['id']) || !ctype_digit((string)$_REQUEST['id'])) {
    http_response_code(400);
    exit('Invalid identifier');
}
$id = (int) $_REQUEST['id'];