CVE-2024-9093: Profile Registration SQL Injection Flaw

CVE-2024-9093 Overview

CVE-2024-9093 is a SQL injection vulnerability in SourceCodester Profile Registration without Reload Refresh 1.0. The flaw resides in the del.php script, where the list GET parameter is passed directly into a database query without sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements against the backend database. The exploit details have been publicly disclosed, increasing the risk of opportunistic exploitation against exposed installations. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated or low-privilege remote attackers can read, modify, or delete records in the application database through the vulnerable list GET parameter in del.php.

Affected Products

Rems Profile Registration without Reload/Refresh 1.0
Component: del.php GET Parameter Handler
Distribution: SourceCodester

Discovery Timeline

2024-09-23 - CVE-2024-9093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9093

Vulnerability Analysis

The vulnerability resides in del.php, a script responsible for deleting profile records. The script accepts a list parameter through an HTTP GET request and embeds the value directly into a SQL statement. Because the code performs no input validation, escaping, or parameterization, attacker-controlled data is concatenated into the query string.

An attacker sends a crafted request such as del.php?list=<payload> to influence the WHERE clause. This allows arbitrary SQL to execute in the context of the application's database user. The EPSS score is 0.541% with a percentile of 42.6, indicating a moderate exploitation likelihood relative to other published CVEs.

Root Cause

The root cause is missing input sanitization on the list GET parameter combined with dynamic SQL construction. The application concatenates user input directly into the query rather than using prepared statements with bound parameters. This anti-pattern is the canonical trigger for [CWE-89] SQL Injection.

Attack Vector

Exploitation requires only network access to the vulnerable web application and a low-privileged account or reachable endpoint. Attackers can craft GET requests that modify query logic through union-based, boolean-based, or time-based injection techniques. Successful exploitation can enable data exfiltration, authentication bypass, or destructive database operations. Details of the exploitation technique are documented in the GitHub CVE SQL Injection Report and VulDB #278271.

Detection Methods for CVE-2024-9093

Indicators of Compromise

HTTP GET requests to del.php with the list parameter containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences like -- and /*.
Web server access logs showing repeated requests to del.php from a single source with varying list values, indicative of automated fuzzing.
Database error messages returned to clients or logged locally that reference SQL syntax errors originating from del.php.

Detection Strategies

Inspect web application logs for anomalous query strings targeting del.php and correlate them with client IP and User-Agent patterns.
Deploy a web application firewall (WAF) with signatures for SQL injection payloads and enable logging in blocking mode.
Enable database query logging to identify unusual DELETE, UNION SELECT, or information_schema access originating from the application account.

Monitoring Recommendations

Alert on HTTP 500 responses from del.php that coincide with suspicious query strings, since these often indicate injection probing.
Baseline normal parameter values for list and flag deviations such as non-integer input or excessive length.
Monitor outbound traffic from the web server for unexpected data exfiltration following requests to del.php.

How to Mitigate CVE-2024-9093

Immediate Actions Required

Restrict network access to the application until remediation is applied, using firewall rules or authentication proxies.
Deploy WAF rules that block SQL metacharacters in the list parameter of del.php.
Audit database logs and user tables for signs of unauthorized modification or data disclosure.

Patch Information

No vendor patch is listed in the referenced advisories for Rems Profile Registration without Reload/Refresh 1.0. Administrators should refactor del.php to use prepared statements with parameterized queries, validate that list is a strict integer, and remove the vulnerable endpoint from production if the application cannot be updated. Refer to the VulDB entry and SourceCodester Security Resources for further guidance.

Workarounds

Replace the vulnerable query in del.php with a prepared statement using PDO or MySQLi parameter binding.
Add server-side validation that rejects any list value that is not a positive integer before the parameter reaches SQL construction.
Apply least-privilege principles to the database account used by the application, restricting DELETE and schema access where possible.

bash

# Example Apache mod_rewrite rule to block non-numeric list parameters on del.php
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/del\.php$
RewriteCond %{QUERY_STRING} (^|&)list=([^0-9&]|%27|%22|--|/\*)
RewriteRule ^ - [F,L]