CVE-2024-9035: Blood Bank Management System SQLi Flaw

CVE-2024-9035 Overview

CVE-2024-9035 is a SQL injection vulnerability in code-projects Blood Bank Management System 1.0. The flaw exists in the Admin Login component at /admin/login.php, where the username and password parameters are not properly sanitized before being incorporated into SQL queries. Remote, unauthenticated attackers can manipulate these parameters to alter query logic and bypass authentication or extract data from the backend database. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote unauthenticated attackers can inject SQL through the admin login form to bypass authentication and read or modify database contents.

Affected Products

• code-projects Blood Bank Management System 1.0
• Component: Admin Login (/admin/login.php)
• Vulnerable parameters: username and password

Discovery Timeline

• 2024-09-20 - CVE-2024-9035 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2024-9035

Vulnerability Analysis

The vulnerability resides in the administrative login handler at /admin/login.php. The application concatenates the username and password POST parameters directly into a SQL query without parameterization or input sanitization. An attacker can submit crafted input containing SQL metacharacters to break out of the intended query context. This permits authentication bypass and arbitrary read or write operations against the underlying database. The attack requires no authentication and no user interaction, and it can be executed over the network against any reachable instance.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The login routine builds a query string using untrusted client input rather than using prepared statements with bound parameters. Because the application also fails to apply input validation or output encoding, attacker-supplied SQL fragments are interpreted as code by the database engine.

Attack Vector

An attacker sends an HTTP POST request to the admin login endpoint with malicious payloads in the username or password fields. Classic payloads such as tautology-based bypasses (for example, supplying a string that closes the quoted value and appends an always-true condition) can authenticate the attacker as the first administrative user. UNION-based or boolean-blind techniques can be used to enumerate database schema and exfiltrate records, including credentials and donor information.

No verified proof-of-concept code is published in the referenced advisories. Technical details are available in the GitHub CVE SQL Documentation and the VulDB entry #278205.

Detection Methods for CVE-2024-9035

Indicators of Compromise

• POST requests to /admin/login.php containing SQL metacharacters such as single quotes, --, #, OR 1=1, or UNION SELECT in the username or password fields.
• Successful admin authentication events with no preceding password reset or onboarding activity.
• Web server logs showing repeated login attempts from a single source with varying payload lengths, indicating automated injection tooling.
• Database error messages returned in HTTP responses referencing MySQL syntax errors near user-supplied input.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the /admin/login.php endpoint.
• Enable database query logging and alert on queries containing tautologies, stacked statements, or INFORMATION_SCHEMA references originating from the application user.
• Correlate authentication success events with the raw HTTP request body to identify bypass attempts.

Monitoring Recommendations

• Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
• Alert on anomalous admin session creation outside business hours or from unfamiliar IP ranges.
• Track HTTP response codes and response sizes for /admin/login.php to identify blind injection probing.

How to Mitigate CVE-2024-9035

Immediate Actions Required

• Restrict network access to the /admin/ directory using IP allow-listing or VPN-only access until a patched version is available.
• Deploy a WAF rule set that blocks SQL injection payloads targeting the login form.
• Audit the admin user table and application database for unauthorized accounts, data modification, or exfiltration indicators.
• Rotate all administrative credentials and database account passwords used by the application.

Patch Information

At the time of publication, no vendor patch has been listed in the referenced advisories. Operators should monitor code-projects.org for updates. Where feasible, replace the application with a maintained alternative, or modify the source to use parameterized queries via PHP Data Objects (PDO) or mysqli prepared statements and apply server-side input validation on the username and password fields.

Workarounds

• Place the application behind an authenticating reverse proxy so that the admin login is not directly reachable from the internet.
• Disable verbose database error reporting in PHP by setting display_errors = Off and configuring application-level error handling to prevent information disclosure during injection probing.
• Apply least-privilege principles to the database user used by the application, removing DROP, ALTER, and FILE privileges to limit damage from a successful injection.
• Implement rate limiting and account lockout on the login endpoint to slow automated exploitation.

# Example WAF rule (ModSecurity) to block common SQLi tokens on the admin login endpoint
SecRule REQUEST_URI "@streq /admin/login.php" \
    "phase:2,chain,deny,status:403,id:1009035,msg:'Blocked SQLi attempt on admin login'"
    SecRule ARGS:username|ARGS:password "@rx (?i)(union(\s|/\*.*\*/)+select|or\s+1=1|--|#|';)" "t:none"