CVE-2024-12485: Online Class Scheduling System SQLi Flaw

CVE-2024-12485 Overview

CVE-2024-12485 is a SQL injection vulnerability in code-projects Online Class and Exam Scheduling System 1.0. The flaw resides in the /pages/department.php script, where the id parameter is passed directly into a database query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements against the backend database. The vulnerability is remotely exploitable and requires low-privileged authentication. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. This weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote authenticated attackers can inject SQL statements through the id parameter of department.php, potentially exposing or modifying database records.

Affected Products

Fabian Online Class and Exam Scheduling System 1.0
Component: /pages/department.php
CPE: cpe:2.3:a:fabian:online_class_and_exam_scheduling_system:1.0

Discovery Timeline

2024-12-12 - CVE-2024-12485 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12485

Vulnerability Analysis

The vulnerability exists in the department.php page of the Online Class and Exam Scheduling System. The application accepts the id GET parameter and incorporates it into a SQL query without input validation or parameterized statements. An authenticated attacker with low privileges can supply crafted input to break out of the intended query context. Successful exploitation allows the attacker to read, modify, or delete database contents. The public disclosure of exploit details in the referenced VulDB and GitHub artifacts lowers the technical barrier for opportunistic attackers. The EPSS score for this CVE is 0.545% as of 2026-08-11.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter, classified under [CWE-74]. The department.php script concatenates the id value directly into a SQL statement rather than using prepared statements or parameterized queries. No server-side sanitization or type enforcement is applied to the id argument before it reaches the database driver.

Attack Vector

The attack vector is network-based and requires low-privileged application access. An attacker sends an HTTP request to /pages/department.php with a malicious payload appended to the id query string parameter. Typical payloads use boolean-based, union-based, or time-based blind SQL injection techniques to enumerate schema, extract data, or bypass authorization checks. No user interaction is required. See the GitHub CVE Document and VulDB #287867 for the disclosed technical details.

Detection Methods for CVE-2024-12485

Indicators of Compromise

HTTP requests to /pages/department.php containing SQL meta-characters such as ', ", --, UNION, SELECT, or SLEEP( in the id parameter.
Database error messages returned to clients following requests to department.php.
Unusual response time variance on department.php requests, consistent with time-based blind injection.
Access log entries showing repeated id value enumeration from a single source address.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter of /pages/department.php for SQL injection signatures.
Enable database query logging and alert on syntactically anomalous queries originating from the application service account.
Correlate web access logs with database audit logs to identify requests that produced schema-level queries.

Monitoring Recommendations

Monitor outbound data volumes from the application database for spikes consistent with data exfiltration.
Track authentication events for the application and flag low-privileged accounts making high-frequency requests to department.php.
Alert on database errors originating from PHP frontend components.

How to Mitigate CVE-2024-12485

Immediate Actions Required

Restrict network access to the Online Class and Exam Scheduling System to trusted internal networks or VPN clients.
Disable or remove access to /pages/department.php if the functionality is not required.
Rotate database credentials used by the application and enforce least-privilege on the database account.
Review web server and database logs for prior exploitation attempts against the id parameter.

Patch Information

No official vendor patch is listed in the referenced advisories. The vendor has not published a fixed version at the time of NVD publication. Operators should track the Code Projects Resource Hub and VulDB CTI #287867 for future updates.

Workarounds

Place the application behind a WAF configured to block SQL injection patterns targeting the id parameter.
Modify department.php locally to use parameterized queries or PDO prepared statements before database submission.
Enforce strict type validation on the id parameter, rejecting any non-integer values at the web server layer.
Apply URL-based access controls to require authentication and referer validation for /pages/department.php.

bash

# Example ModSecurity rule blocking SQLi in the id parameter
SecRule ARGS:id "@rx (?i)(union|select|sleep\(|--|';|\"|/\*)" \
    "id:1002485,phase:2,deny,status:403,\
    msg:'CVE-2024-12485 SQLi attempt on department.php id parameter'"