CVE-2024-9037: Internal Marks Calculation SQLi Flaw

CVE-2024-9037 Overview

CVE-2024-9037 is a SQL injection vulnerability in Codezips Internal Marks Calculation 1.0. The flaw resides in an unspecified function within index.php, where the tid parameter is passed directly to a database query without sanitization. Attackers can exploit the issue remotely without authentication or user interaction. The exploit details have been disclosed publicly, increasing the risk of opportunistic attacks against exposed instances. The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can manipulate the tid parameter in index.php to inject arbitrary SQL, compromising database confidentiality, integrity, and availability.

Affected Products

Codezips Internal Marks Calculation 1.0
CPE: cpe:2.3:a:codezips:internal_marks_calculation:1.0:*:*:*:*:*:*:*
Component: codezips:internal_marks_calculation

Discovery Timeline

2024-09-20 - CVE-2024-9037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9037

Vulnerability Analysis

The application exposes a SQL injection sink through the tid GET parameter handled by index.php. The parameter value is concatenated into a SQL statement without parameterization or input validation. Attackers craft requests containing SQL metacharacters and stacked clauses to alter query logic. Successful injection allows extraction of database contents, modification of stored records, and potential authentication bypass.

The flaw is reachable over the network without credentials. Because the affected application handles academic mark calculations, the underlying database likely contains personal student information and grading data. Public disclosure of the exploit lowers the skill required to weaponize the vulnerability. The EPSS probability of 0.581% (43.2 percentile) suggests measurable interest from automated scanners.

Root Cause

The root cause is improper neutralization of special elements in SQL commands, identified as [CWE-89]. User-controlled input from the tid request parameter is interpolated directly into a SQL query string. The application lacks prepared statements, parameter binding, and allow-list validation on the tid value.

Attack Vector

The attack vector is remote over HTTP. An attacker sends a crafted GET or POST request to index.php supplying a malicious tid value containing SQL syntax. No authentication, privileges, or user interaction are required. Typical payloads include UNION SELECT statements to exfiltrate data, boolean-based blind techniques for inference, and time-based payloads using database sleep functions.

For exploitation details, see the GitHub CVE Documentation and VulDB entry #278208.

Detection Methods for CVE-2024-9037

Indicators of Compromise

HTTP requests targeting index.php with SQL keywords such as UNION, SELECT, SLEEP, OR 1=1, or comment delimiters (--, /*) in the tid parameter.
URL-encoded SQL metacharacters (%27, %23, %2D%2D) within the tid query string.
Database error messages returned in HTTP responses referencing MySQL or MariaDB syntax errors.
Unusual outbound database connections or large result sets originating from the web application backend.

Detection Strategies

Deploy web application firewall (WAF) rules to flag SQL syntax in the tid parameter of index.php.
Enable database query logging and alert on anomalously long or malformed queries against tables used by the application.
Correlate web access logs with application error logs to identify probing attempts followed by successful injection payloads.

Monitoring Recommendations

Monitor HTTP traffic to /index.php?tid= for repeated requests from a single source within short time windows.
Track 500-series responses and database connection error rates as proxy indicators of injection probing.
Audit query patterns from the application service account for unexpected INFORMATION_SCHEMA or mysql.user access.

How to Mitigate CVE-2024-9037

Immediate Actions Required

Restrict network access to the Codezips Internal Marks Calculation application to trusted networks until a fix is applied.
Place the application behind a WAF with SQL injection signatures enabled for the tid parameter.
Review database logs for evidence of prior exploitation, focusing on the period since 2024-09-20.
Rotate database credentials used by the application if compromise is suspected.

Patch Information

No vendor patch has been published for CVE-2024-9037 at the time of writing. No vendor advisory URLs are listed in the NVD record. Operators should monitor the VulDB entry and Codezips distribution channels for updates.

Workarounds

Modify the application source to replace string concatenation in the affected query with parameterized statements (e.g., PDO prepared statements with bound parameters).
Enforce server-side input validation on tid, accepting only expected numeric values and rejecting all other inputs.
Apply least-privilege database permissions to the application account, removing FILE, DROP, and cross-database access rights.
Consider taking the application offline if it processes sensitive academic data and cannot be patched immediately.

bash

# Example WAF rule (ModSecurity) blocking SQLi attempts on tid
SecRule ARGS:tid "@detectSQLi" \
    "id:1009037,phase:2,deny,status:403,\
    msg:'CVE-2024-9037 SQLi attempt on tid parameter',\
    logdata:'Matched data: %{MATCHED_VAR}'"