CVE-2024-12890: Online Exam Mastering System SQL Injection

CVE-2024-12890 Overview

CVE-2024-12890 is a SQL injection vulnerability affecting code-projects Online Exam Mastering System 1.0. The flaw resides in the /update.php?q=quiz&step=2 endpoint, where the eid parameter is passed to a backend database query without proper sanitization. Remote attackers with low-level authentication can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject SQL statements through the eid parameter, potentially exposing or modifying exam data stored in the backend database.

Affected Products

code-projects Online Exam Mastering System 1.0
CPE: cpe:2.3:a:code-projects:online_exam_mastering_system:1.0
Component: update.php (quiz update handler)

Discovery Timeline

2024-12-22 - CVE-2024-12890 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12890

Vulnerability Analysis

The vulnerability exists in the quiz update workflow of Online Exam Mastering System 1.0. When the application processes requests to /update.php?q=quiz&step=2, it reads the eid (exam identifier) parameter directly from the request. The value is concatenated into a SQL query without parameterized statements or input validation. This allows attackers to break out of the intended query context and append arbitrary SQL clauses.

Because the attack occurs over the network and requires only low-privilege authentication, any user with a valid account, including self-registered students, can trigger the flaw. Successful exploitation can lead to unauthorized reads of exam questions, answer keys, user credentials, and grade tables. Depending on database privileges, attackers may also modify records or pivot to other data stored on the same database server.

Root Cause

The root cause is improper neutralization of user-supplied input in a downstream SQL query. The update.php script does not enforce type checking, whitelist validation, or prepared statements on the eid parameter before it reaches the database driver.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /update.php?q=quiz&step=2 with a malicious eid payload containing SQL syntax such as UNION SELECT clauses or boolean-based blind primitives. The backend concatenates the payload into the query, executes it, and returns results or observable side effects. No user interaction is required beyond the attacker's session. Refer to the VulDB advisory and the public write-up on HackMD for technical details on the disclosed payload.

Detection Methods for CVE-2024-12890

Indicators of Compromise

HTTP requests to /update.php?q=quiz&step=2 where the eid parameter contains SQL keywords such as UNION, SELECT, SLEEP, --, or single quotes
Database logs showing unexpected queries against exam, user, or credential tables originating from the web application service account
Web server access logs recording abnormally long eid values or repeated requests with incrementing payload variations
Sudden spikes in 500 or 200 responses to the update.php endpoint from a single authenticated session

Detection Strategies

Deploy web application firewall (WAF) rules that match SQL injection signatures on the eid query parameter
Enable database audit logging and alert on queries referencing schema metadata tables (information_schema) issued by the exam application account
Correlate authenticated session identifiers with anomalous query patterns to identify low-privilege accounts probing the endpoint

Monitoring Recommendations

Forward web, application, and database logs to a centralized analytics platform for cross-source correlation
Baseline normal eid parameter values (numeric identifiers) and alert on deviations containing non-numeric characters
Review authentication logs for newly registered accounts that immediately access update.php

How to Mitigate CVE-2024-12890

Immediate Actions Required

Restrict network access to the Online Exam Mastering System until a fixed version or code patch is available
Disable or gate the /update.php?q=quiz&step=2 endpoint behind additional authorization checks where feasible
Audit the database for unauthorized reads or modifications to exam, user, and credential tables
Rotate database and application credentials if exploitation is suspected

Patch Information

No official vendor patch has been published for code-projects Online Exam Mastering System 1.0 at the time of this advisory. Organizations should monitor the code-projects site and VulDB entry #289151 for updates. Until an upstream fix is released, remediation requires modifying the update.php source to use parameterized queries (prepared statements) via PDO or MySQLi with bound parameters, and enforcing strict integer validation on the eid value before it reaches the query builder.

Workarounds

Implement a reverse proxy or WAF rule that rejects requests to update.php where eid is non-numeric
Apply a virtual patch that enforces a regex whitelist (^[0-9]+$) on the eid parameter at the perimeter
Restrict the database account used by the application to least privilege, removing DDL and cross-schema access
Consider removing the application from production use if it cannot be patched, given the public disclosure of the exploit

bash

# Example WAF rule (ModSecurity) to block non-numeric eid values
SecRule ARGS:eid "!@rx ^[0-9]+$" \
    "id:1002890,phase:2,deny,status:403,\
    msg:'CVE-2024-12890 - Non-numeric eid parameter blocked'"