CVE-2024-10760: University Event Management System SQL Injection

CVE-2024-10760 Overview

CVE-2024-10760 is a SQL injection vulnerability in code-projects University Event Management System 1.0. The flaw resides in the /dodelete.php script, where the id parameter is passed directly into a database query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely and requires only low-privilege authentication. Public disclosure of the exploit technique has already occurred, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Remote authenticated attackers can execute arbitrary SQL queries against the application database, enabling data theft, modification, or deletion of event and user records.

Affected Products

code-projects University Event Management System 1.0
Anisha University Event Management System (all deployments of version 1.0)
Web applications built on the dodelete.php handler in this codebase

Discovery Timeline

2024-11-04 - CVE-2024-10760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10760

Vulnerability Analysis

The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. The /dodelete.php endpoint accepts an id parameter used to identify the record slated for deletion. That parameter is concatenated into a SQL statement without parameterization or escape handling. An attacker supplying crafted input can break out of the intended query context and append arbitrary SQL clauses. Because the vulnerable script is delete-oriented, injection payloads can extend beyond SELECT operations to affect data integrity across related tables.

Root Cause

The root cause is the direct concatenation of user-supplied input into a SQL query string within dodelete.php. The application does not use prepared statements, parameterized queries, or input validation for the id argument. This design pattern is characteristic of PHP applications built with legacy mysql_* or unsafe mysqli string-building approaches.

Attack Vector

The attack is delivered remotely over HTTP against the vulnerable endpoint. An authenticated user with minimal privileges submits a request to /dodelete.php with a manipulated id value containing SQL metacharacters. No user interaction beyond the attacker's own request is required. Successful exploitation can enable unauthorized data disclosure, tampering with event records, or destructive operations across the application database. Technical details are documented in the GitHub CVE SQL Analysis and the VulDB #282929 entry.

Detection Methods for CVE-2024-10760

Indicators of Compromise

HTTP requests to /dodelete.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, ;, or OR 1=1 within the id parameter
Unexpected DELETE, UPDATE, or DROP statements in database query logs correlated with web server access to dodelete.php
Database errors or long-running queries triggered by requests to the delete endpoint
Sudden loss or modification of event, attendee, or administrative records without corresponding administrative activity

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter of /dodelete.php for SQL injection signatures
Enable verbose database query logging and alert on syntactically anomalous queries originating from the application service account
Correlate web server access logs with database audit logs to identify parameter tampering targeting delete operations

Monitoring Recommendations

Monitor for repeated HTTP 500 responses or database exception messages returned from dodelete.php
Track authentication events preceding suspicious deletion requests to identify compromised low-privilege accounts
Baseline normal query patterns for the application and alert on deviations such as multi-statement queries or use of information_schema

How to Mitigate CVE-2024-10760

Immediate Actions Required

Restrict access to the University Event Management System to trusted networks or take the application offline until it can be remediated
Rotate database credentials used by the application and audit the database for unauthorized changes
Review web server logs for prior exploitation attempts against /dodelete.php
Enforce least-privilege permissions on the database account used by the application to limit the blast radius of injection

Patch Information

No official vendor patch is listed for code-projects University Event Management System 1.0. Administrators should modify dodelete.php to use parameterized queries via mysqli prepared statements or PDO with bound parameters. Consult the VulDB #282929 advisory and the Code Projects Resource Hub for any subsequent vendor updates.

Workarounds

Place the application behind a WAF with SQL injection signatures enforced on all parameters, particularly id
Implement server-side input validation to ensure the id parameter contains only numeric characters before it reaches the database layer
Disable or remove the vulnerable dodelete.php endpoint if the delete workflow is not required in production
Enforce strict database user privileges so the application account cannot execute DROP, ALTER, or cross-schema queries

bash

# Example nginx configuration to block non-numeric id values on the vulnerable endpoint
location = /dodelete.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}