CVE-2024-9094: Blood Bank System SQL Injection Flaw

CVE-2024-9094 Overview

CVE-2024-9094 is a SQL injection vulnerability in code-projects Blood Bank System 1.0. The flaw resides in the /admin/blood/update/o-.php script, where the bloodname parameter is passed to a database query without proper sanitization. An attacker with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote attackers can read, modify, or delete records in the blood bank database by injecting SQL through the bloodname parameter, potentially exposing donor information and corrupting medical inventory data.

Affected Products

• code-projects Blood Bank System 1.0
• Deployments using the vulnerable /admin/blood/update/o-.php endpoint
• Web applications derived from the same code base

Discovery Timeline

• 2024-09-23 - CVE-2024-9094 published to NVD
• 2024-09-27 - Last updated in NVD database

Technical Details for CVE-2024-9094

Vulnerability Analysis

The vulnerability is a classic SQL injection in the administrative update workflow of code-projects Blood Bank System 1.0. The /admin/blood/update/o-.php script accepts the bloodname argument from HTTP request input and concatenates it directly into a SQL statement. Because the application does not use parameterized queries or input validation, an attacker can break out of the intended string context and append arbitrary SQL clauses.

The attack can be carried out remotely over the network. Authenticated low-privilege access to the administrative interface is required, but credentials for such applications are frequently weak or default. Public disclosure of the exploit details on the GitHub CVE Documentation lowers the skill barrier for attackers.

Root Cause

The root cause is missing input neutralization in o-.php. The bloodname parameter flows from the request into a SQL query without prepared statements, parameter binding, or escaping. This violates secure coding practices for database access and matches the pattern described in CWE-89.

Attack Vector

An attacker submits a crafted HTTP request to the /admin/blood/update/o-.php endpoint with a malicious bloodname value. The injected payload alters the resulting SQL statement to extract data through UNION-based queries, modify records with stacked statements, or trigger time-based blind extraction. Successful exploitation can disclose donor records, alter blood inventory, or pivot toward further compromise of the database server.

No verified proof-of-concept code is republished here. See the GitHub CVE Documentation and VulDB entry #278272 for the disclosed technical details.

Detection Methods for CVE-2024-9094

Indicators of Compromise

• HTTP requests to /admin/blood/update/o-.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA in the bloodname parameter
• Web server access logs showing unusually long or URL-encoded bloodname values from external IP addresses
• Database error messages or stack traces surfacing in application responses following requests to the update endpoint
• Unexpected modifications to blood inventory tables or new administrative records without corresponding legitimate activity

Detection Strategies

• Deploy a web application firewall rule that inspects POST and GET parameters to /admin/blood/update/o-.php for SQL injection signatures
• Enable database query logging and alert on queries originating from the application that contain UNION SELECT, boolean tautologies, or sleep functions
• Correlate authentication events for the admin interface with subsequent anomalous query patterns to identify abuse of low-privilege accounts

Monitoring Recommendations

• Continuously monitor web server logs for repeated 500-series responses tied to the vulnerable endpoint
• Track outbound database connections and data volume from the application host for signs of bulk extraction
• Alert on creation or modification of administrative users in the Blood Bank System database outside of change windows

How to Mitigate CVE-2024-9094

Immediate Actions Required

• Restrict network access to the /admin/ directory using IP allow-listing or VPN-only access until a fix is deployed
• Audit the Blood Bank System database for unauthorized changes to donor and inventory tables
• Rotate all administrative credentials and enforce strong password policies on the admin portal
• Place a web application firewall in blocking mode in front of the application with SQL injection rules tuned to the bloodname parameter

Patch Information

No official vendor patch is listed in the NVD record or on the code-projects site at the time of publication. Organizations running this software should treat the deployment as unsupported for production use and consider migrating to a maintained alternative. Track the VulDB entry #278272 for any subsequent fix advisories.

Workarounds

• Modify the vulnerable o-.php script to use parameterized queries with PDO or mysqli_prepare instead of string concatenation
• Add server-side input validation that restricts bloodname to an allow-list of expected characters before it reaches the query layer
• Disable or remove the /admin/blood/update/o-.php endpoint if the update functionality is not required in the deployment
• Run the database account used by the application with the minimum privileges needed, eliminating DDL and cross-database access

# Example WAF rule snippet (ModSecurity) to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /admin/blood/update/o-.php" \
    "id:1009094,phase:2,deny,status:403,log,msg:'CVE-2024-9094 SQLi attempt',\
    chain"
    SecRule ARGS:bloodname "@detectSQLi" "t:none,t:urlDecodeUni"