CVE-2024-9894: Blood Bank System SQL Injection Vulnerability

CVE-2024-9894 Overview

CVE-2024-9894 is a SQL injection vulnerability in code-projects Blood Bank System 1.0. The flaw exists in the reset.php script, where the useremail parameter is passed directly into a SQL query without proper sanitization. An attacker can send crafted input over the network to manipulate database queries. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is tracked under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote attackers can inject arbitrary SQL through the useremail parameter in reset.php, potentially exposing or modifying blood donor and user data stored in the application database.

Affected Products

code-projects Blood Bank System 1.0
reset.php password reset endpoint
Installations exposing the application to untrusted networks

Discovery Timeline

2024-10-12 - CVE-2024-9894 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9894

Vulnerability Analysis

The vulnerability resides in the password reset flow of the Blood Bank System 1.0 application. The reset.php script accepts a user-supplied useremail value and concatenates it into a SQL query executed against the backend database. Because the input is neither parameterized nor escaped, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires only network access to the application and low-privilege interaction with the reset workflow. No user interaction is needed once a request is crafted. The public disclosure of the exploit lowers the barrier for automated scanning and mass exploitation of exposed instances. EPSS data places the exploitation probability at 0.532%.

Root Cause

The root cause is missing input validation and the absence of prepared statements in the reset.php handler. User-controlled data flows directly into a dynamically constructed SQL statement. This design pattern violates secure coding practices defined in [CWE-89].

Attack Vector

An attacker submits a specially crafted useremail parameter to the reset.php endpoint over HTTP. The injected payload alters the query logic, allowing the attacker to enumerate tables, extract credentials, or modify records. Because authentication is not required to reach the reset endpoint in most deployments, exploitation can be performed by unauthenticated remote actors. Refer to the GitHub CVE SQL Analysis for a technical walkthrough of the injection point.

No verified proof-of-concept code is republished here. Technical details are available in the referenced advisory.

Detection Methods for CVE-2024-9894

Indicators of Compromise

HTTP POST or GET requests to reset.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or OR 1=1 inside the useremail parameter.
Web server logs showing repeated reset attempts from a single source with abnormal email field lengths.
Unexpected database errors, stack traces, or long response times originating from the reset endpoint.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the useremail parameter for SQL syntax patterns.
Enable database query logging and alert on queries containing tautologies or UNION SELECT statements originating from the reset workflow.
Correlate authentication and reset activity to identify anomalous email inputs that do not conform to RFC 5322 formatting.

Monitoring Recommendations

Monitor outbound database traffic from the application host for volumes inconsistent with normal reset activity.
Track access patterns to reset.php for repeated failed submissions or automated scanner user agents.
Alert on unexpected read access to sensitive tables such as users, admin, or donors following requests to reset.php.

How to Mitigate CVE-2024-9894

Immediate Actions Required

Restrict public access to the Blood Bank System 1.0 application until a fix is applied, using network ACLs or a reverse proxy allowlist.
Deploy WAF signatures blocking SQL injection payloads against the reset.php endpoint.
Review database logs for evidence of prior injection attempts against the useremail parameter.

Patch Information

No official vendor patch has been published for code-projects Blood Bank System 1.0. Operators should treat the application as vulnerable and consider migrating to a maintained alternative. Consult the Code Projects Resource Hub and VulDB #280164 entries for advisory updates.

Workarounds

Modify reset.php to use parameterized queries or prepared statements via PDO or mysqli with bound parameters.
Add server-side input validation that enforces RFC 5322 email formatting before any database interaction.
Apply least-privilege database credentials so the application account cannot read or modify tables outside its required scope.
Place the application behind an authenticated VPN or IP allowlist if it is used only by internal staff.

bash

# Example WAF rule concept (ModSecurity) - review before deploying
SecRule ARGS:useremail "@rx (?i)(union(\s|/\*.*\*/)+select|--|\bor\b\s+\d+=\d+|';)" \
    "id:1009894,phase:2,deny,status:403,msg:'CVE-2024-9894 SQLi attempt on reset.php'"