CVE-2024-3536: Campcodes Church Management System SQLI Flaw

CVE-2024-3536 Overview

CVE-2024-3536 is a SQL injection vulnerability in Campcodes Church Management System 1.0. The flaw resides in the /admin/delete_log.php script, where the selector parameter is passed to a database query without proper sanitization. Remote attackers with low privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks. The vulnerability is tracked as VulDB identifier VDB-259906 and classified under [CWE-89]: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can extract, modify, or destroy database contents by injecting SQL through the selector argument in delete_log.php.

Affected Products

Campcodes Church Management System 1.0
Deployments exposing /admin/delete_log.php to authenticated users
Instances using default administrative access controls

Discovery Timeline

2024-04-10 - CVE-2024-3536 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3536

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in a PHP-based web application. The delete_log.php administrative endpoint accepts a selector argument from the HTTP request. This value is concatenated directly into a SQL query executed against the backend database. Attackers can supply crafted input that alters the query structure, enabling unauthorized data operations.

The issue requires network access and low privileges, meaning any authenticated user with access to the admin interface can trigger it. Successful exploitation can lead to full compromise of the underlying database, including confidentiality, integrity, and availability impact. Public disclosure of exploit details raises the likelihood of automated scanning and abuse against exposed instances.

Root Cause

The root cause is missing input validation and lack of parameterized queries in the delete_log.php handler. User-controlled input from the selector parameter is interpolated into a SQL statement without escaping or type enforcement. Church Management System 1.0 does not use prepared statements at this location, which is the standard defense against injection.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /admin/delete_log.php with a malicious selector value. The payload manipulates the SQL DELETE statement to append additional clauses, subqueries, or UNION operations. The vulnerability is exploitable remotely over the network without user interaction. Refer to the GitHub CVE Documentation and VulDB #259906 for the disclosed exploit details.

Detection Methods for CVE-2024-3536

Indicators of Compromise

HTTP requests to /admin/delete_log.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the selector parameter.
Web server access logs showing repeated requests to delete_log.php from a single source with varying selector values.
Unexpected DELETE, UPDATE, or SELECT statements in database query logs correlated with admin session activity.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the selector parameter on delete_log.php for SQL syntax and blocks anomalous payloads.
Enable database query logging and alert on statements originating from the application user that contain unusual concatenation patterns.
Correlate authenticated admin session activity with sudden bulk deletion or extraction of records.

Monitoring Recommendations

Monitor administrative endpoints for parameter tampering and anomalous input length or character distribution.
Track failed authentication attempts followed by successful logins targeting the admin panel.
Review outbound network traffic from the web server for signs of data exfiltration following admin activity.

How to Mitigate CVE-2024-3536

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists or VPN-only access until a fix is applied.
Rotate administrator credentials and enforce strong password policies on all admin accounts.
Audit database logs and application logs for evidence of prior exploitation of the selector parameter.

Patch Information

No vendor advisory or official patch has been published for Campcodes Church Management System 1.0. Organizations running this application should evaluate whether continued use is acceptable given the disclosed exploit and absence of a vendor fix. Consider migrating to a maintained alternative.

Workarounds

Apply virtual patching through a WAF to reject requests to delete_log.php containing SQL syntax in the selector argument.
Modify the application source to use parameterized queries or PDO prepared statements in delete_log.php.
Enforce least-privilege database accounts so the application user cannot perform destructive operations beyond required scope.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/delete_log.php" \
    "chain,phase:2,deny,status:403,id:1002024,\
    msg:'Potential SQLi on CVE-2024-3536 selector parameter'"
    SecRule ARGS:selector "@rx (?i)(union|select|insert|update|delete|--|;|')" \
        "t:none,t:urlDecodeUni"