CVE-2024-9009 in Online Quiz Site
Summary
by MITRE • 09/20/2024
A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file showtest.php. The manipulation of the argument subid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2025
The vulnerability identified as CVE-2024-9009 represents a critical sql injection flaw within the code-projects Online Quiz Site 1.0 application. This vulnerability specifically resides in the showtest.php file where the subid parameter is processed without adequate input validation or sanitization. The flaw allows attackers to manipulate the subid argument in ways that can execute arbitrary sql commands against the underlying database system. The vulnerability's classification as critical indicates the severe potential impact on system integrity and data confidentiality, as sql injection attacks can enable complete database compromise including data exfiltration, modification, or deletion.
The technical nature of this vulnerability aligns with CWE-89 which defines sql injection as the insertion of malicious sql code into input fields for execution by the database. The attack vector is remote, meaning that an attacker can exploit this vulnerability without requiring physical access to the system or direct network connection to the database server. The disclosure of the exploit to the public community significantly increases the risk profile as malicious actors can readily implement the attack without requiring advanced technical knowledge. This remote exploit capability makes the vulnerability particularly dangerous as it can be targeted from anywhere on the internet.
The operational impact of CVE-2024-9009 extends beyond simple data theft to encompass complete system compromise and potential service disruption. An attacker exploiting this vulnerability could gain unauthorized access to sensitive user data, quiz results, and potentially administrative credentials stored within the database. The vulnerability affects the application's core functionality by allowing manipulation of quiz content and user information, which could lead to misinformation campaigns or unauthorized modifications to educational assessments. Additionally, the compromise of the database could result in denial of service conditions if the attacker chooses to corrupt or delete critical application data.
Mitigation strategies for this vulnerability must be implemented immediately given its critical classification and public exploit availability. The primary remediation involves implementing proper input validation and parameterized queries to prevent sql injection attacks. All user-supplied input, particularly the subid parameter in showtest.php, should undergo strict sanitization and validation before processing. The application should employ prepared statements or parameterized queries to ensure that user input cannot be interpreted as sql commands. Network-level protections such as web application firewalls and intrusion detection systems should be deployed to monitor for exploitation attempts. Additionally, the application should be updated to the latest version if a patch is available, and all unnecessary database privileges should be removed from the application user account to limit potential damage from successful exploitation attempts. The vulnerability also maps to attack techniques in the mitre att&ck framework under initial access and execution phases, specifically targeting the use of sql injection for unauthorized database access and command execution.