CVE-2024-12489: Online Class Scheduling System SQLi Flaw

CVE-2024-12489 Overview

CVE-2024-12489 is a SQL injection vulnerability in code-projects Online Class and Exam Scheduling System 1.0. The flaw resides in the /pages/term.php file, where the id parameter is passed directly into a SQL query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements, allowing unauthorized database access. The exploit requires network access and low-privilege authentication, and public disclosure of exploitation details has already occurred. This weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low-privilege access can execute arbitrary SQL queries against the backend database, potentially exposing or modifying scheduling data.

Affected Products

Fabian Online Class and Exam Scheduling System 1.0
Component: /pages/term.php
Vulnerable parameter: id

Discovery Timeline

2024-12-12 - CVE-2024-12489 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12489

Vulnerability Analysis

The vulnerability exists in the term.php script of the Online Class and Exam Scheduling System. The application accepts an id query parameter and concatenates it directly into a SQL statement executed against the backend database. Because no parameterized queries or input validation are applied, attackers can inject SQL syntax to alter query semantics.

Successful exploitation allows attackers to enumerate database schemas, extract sensitive records such as user credentials and exam schedules, and potentially modify or delete records. The attack requires only a low-privilege authenticated session and can be initiated remotely over the network. Public disclosure of exploitation details increases the likelihood of opportunistic scanning against exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input passed through the id parameter to /pages/term.php. The application constructs SQL queries via string concatenation instead of using prepared statements with bound parameters. This design flaw permits SQL metacharacters to alter query logic at runtime.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to the /pages/term.php endpoint with a malicious payload in the id parameter. Typical payloads use UNION-based, boolean-based, or time-based blind injection techniques to extract data. See the GitHub CVE Document and VulDB Platform Analysis for technical details.

// No verified proof-of-concept code is published in the enriched data set.
// Refer to the linked VulDB and GitHub advisory for reproduction details.

Detection Methods for CVE-2024-12489

Indicators of Compromise

HTTP requests to /pages/term.php containing SQL metacharacters in the id parameter such as single quotes, UNION SELECT, SLEEP(, or -- comment sequences.
Web server logs showing unusually long or URL-encoded id values targeting the term scheduling endpoint.
Database error messages returned in HTTP responses referencing MySQL syntax or column mismatches.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect and block SQL injection payloads targeting the id parameter in /pages/term.php.
Enable database query logging and alert on anomalous query patterns, such as UNION-based statements originating from the application service account.
Correlate authentication events with subsequent SQL errors to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Monitor HTTP access logs for repeated requests to /pages/term.php with varying id values indicative of automated fuzzing.
Track outbound data volume from the database host to detect bulk data exfiltration attempts.
Alert on newly created database users or privilege changes that could indicate post-exploitation activity.

How to Mitigate CVE-2024-12489

Immediate Actions Required

Restrict network access to the Online Class and Exam Scheduling System until a fix is applied, limiting exposure to trusted networks only.
Audit application accounts and revoke unnecessary low-privilege access that could be leveraged to reach the vulnerable endpoint.
Review database and web server logs for prior exploitation attempts against /pages/term.php.

Patch Information

At the time of this writing, no official vendor advisory or patch has been published for Fabian Online Class and Exam Scheduling System 1.0. Consult the Code Projects Security Overview and VulDB #287871 for the latest status.

Workarounds

Modify /pages/term.php to use parameterized queries or prepared statements with bound parameters instead of string concatenation.
Apply strict server-side input validation on the id parameter, allowing only numeric values.
Deploy a WAF with signatures for common SQL injection patterns as a compensating control until source code fixes are applied.
Run the database service with a least-privileged account that cannot access schema metadata or write to sensitive tables.

bash

# Example nginx location block enforcing numeric id values
location /pages/term.php {
    if ($arg_id !~ ^[0-9]+$) {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}