A vulnerability classified as critical was found in code-projects Online Book System 1

CVE-2024-3000 is a login-path SQL injection in code-projects Online Book System 1.0, specifically index.php, where the username, password, login_username, or login_password inputs can be manipulated to bypass authentication and interact with the backend database. The public proof of concept shows a classic 'or 1=1-- - payload against the login flow, and the vulnerable build is the single downloadable 1.0 release distributed as a PHP/MySQL training project.

The vendor/CNA HIGH 7.3 score is reasonable in a lab vacuum, but it overstates enterprise patch urgency. The big downward pressure is deployment reality: this is a hobby/tutorial PHP app typically run under XAMPP or localhost-style setups, not a mainstream enterprise product with broad internet-facing production exposure. So yes, exploitation is easy; no, this should not outrank broadly deployed perimeter software just because the input validation is awful.

Why this verdict

• Downgrade for exposure reality: the app appears to be a downloadable training project typically run under XAMPP/localhost, so the exposed population is tiny compared with mainstream enterprise software.
• Unauthenticated remote SQLi is still real: if a reachable instance exists, exploitation is low-skill and the public PoC makes auth bypass straightforward.
• No KEV + low EPSS: there is no authoritative evidence of broad attacker focus, which matters when triaging thousands of hosts.

Why not higher?

Because the attack chain assumes the enterprise is actually running this specific low-prevalence PHP sample app and has made it reachable. That is a major narrowing factor. Also, there is no strong evidence here of widespread exploitation, mass scanning, or a large installed base that would justify treating it like a perimeter emergency.

Why not lower?

Because once a reachable instance exists, the exploit path is embarrassingly easy: no auth, no user interaction, public payload, and likely immediate session bypass. Even a stray demo server can expose credentials, customer data, or an internal foothold, so this is not pure paperwork risk.

1. Remove internet exposure — If you find this app anywhere, put it behind VPN, IP allowlisting, or internal-only reverse proxying. For a MEDIUM verdict there is no mitigation SLA; go straight to risk reduction as operational hygiene and complete it before the 365-day remediation window if the app cannot be retired sooner.
2. Retire demo installs — Treat code-projects sample apps as shadow IT unless a business owner proves otherwise. There is no mitigation SLA for this severity, so the practical control is inventory and retirement before the remediation deadline rather than emergency change windows.
3. Add WAF or reverse-proxy filtering — Block obvious SQLi metacharacters and rate-limit repeated login attempts to reduce opportunistic abuse. This is only a compensating control; with MEDIUM severity there is no mitigation SLA, but use it to cover gaps while you remove or replace the app within the remediation window.
4. Hunt for local code forks — Search web roots, Git repos, and VM templates for BookStore-master 1, u385439067_store, or the matching index.php login logic. Because there is no vendor patch identified, detection and retirement are the realistic enterprise controls within the 365-day remediation period.

Run this on the target host or against a mounted source tree where the PHP application files live. Invoke it as python3 verify_cve_2024_3000.py /var/www/html/BookStore-master\ 1 or python verify_cve_2024_3000.py C:\xampp\htdocs\BookStore-master 1; no admin rights are required if you can read the app files.

#!/usr/bin/env python3
# verify_cve_2024_3000.py
# Detect likely vulnerable code-projects Online Book System 1.0 login SQLi in index.php
# Exit codes: 0=PATCHED/NOT DETECTED, 1=VULNERABLE, 2=UNKNOWN/ERROR

import os
import re
import sys

PARAM_HINTS = ["username", "password", "login_username", "login_password"]
SQL_HINTS = [
    r"select\s+.*from\s+.*where",
    r"mysqli_query\s*\(",
    r"->query\s*\(",
    r"mysql_query\s*\(",
]
UNSAFE_INPUT_HINTS = [
    r"\$_POST\[['\"]username['\"]\]",
    r"\$_POST\[['\"]password['\"]\]",
    r"\$_REQUEST\[['\"]username['\"]\]",
    r"\$_REQUEST\[['\"]password['\"]\]",
]
SAFE_HINTS = [
    r"prepare\s*\(",
    r"mysqli_prepare\s*\(",
    r"bind_param\s*\(",
    r"PDO\s*\(",
]


def read_file(path):
    with open(path, "r", encoding="utf-8", errors="ignore") as f:
        return f.read()


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2024_3000.py <app_root>")
        sys.exit(2)

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f"UNKNOWN - path not found: {root}")
        sys.exit(2)

    index_php = os.path.join(root, "index.php")
    if not os.path.isfile(index_php):
        print("PATCHED - target app not detected (no index.php at provided root)")
        sys.exit(0)

    try:
        data = read_file(index_php)
    except Exception as e:
        print(f"UNKNOWN - failed to read {index_php}: {e}")
        sys.exit(2)

    lowered = data.lower()

    found_params = sum(1 for p in PARAM_HINTS if p in lowered)
    found_sql = sum(1 for pat in SQL_HINTS if re.search(pat, data, re.I))
    found_unsafe = sum(1 for pat in UNSAFE_INPUT_HINTS if re.search(pat, data, re.I))
    found_safe = sum(1 for pat in SAFE_HINTS if re.search(pat, data, re.I))

    app_markers = ["bookstore-master", "u385439067_store", "online book system"]
    found_markers = sum(1 for m in app_markers if m in lowered)

    # Heuristic decisioning
    if found_params >= 2 and found_sql >= 1 and found_unsafe >= 1 and found_safe == 0:
        print("VULNERABLE - index.php contains likely unsafe login SQL handling consistent with CVE-2024-3000")
        sys.exit(1)

    if found_safe >= 1 and found_sql >= 1 and found_unsafe == 0:
        print("PATCHED - query handling appears parameterized or the vulnerable pattern is absent")
        sys.exit(0)

    if found_markers or found_params >= 2:
        print("UNKNOWN - app may be present, but the vulnerable pattern could not be confirmed from index.php alone")
        sys.exit(2)

    print("PATCHED - application fingerprint not detected at the provided path")
    sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2024-3000
2. Burak Sevben PoC (raw GitHub)
3. code-projects Online Book System project page
4. code-projects download details page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. INCIBE advisory for CVE-2024-3000
8. SOCRadar CVE radar entry