CVE-2024-4804: Kashipara College Management System SQLI

CVE-2024-4804 Overview

CVE-2024-4804 is a SQL injection vulnerability in Kashipara College Management System version 1.0. The flaw resides in the edit_user.php script, where the id parameter is passed directly into a database query without sanitization. Remote attackers with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed under identifier VDB-263924, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Authenticated remote attackers can inject SQL into the id parameter of edit_user.php to read, modify, or delete database records in the College Management System.

Affected Products

Kashipara College Management System 1.0
edit_user.php component
Deployments exposing the administrative interface to untrusted networks

Discovery Timeline

2024-05-14 - CVE-2024-4804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4804

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] affecting the edit_user.php endpoint of Kashipara College Management System 1.0. The id request parameter is concatenated into a SQL query without parameterization or input validation. An attacker who can reach the application over the network and possesses low-privilege credentials can submit crafted id values to alter the query logic.

Successful exploitation allows the attacker to read arbitrary tables, including user credentials, or to modify and delete records. According to the CVSS 4.0 vector, the impact on confidentiality, integrity, and availability is limited to low, reflecting a subset of database contents rather than full system compromise. The EPSS score of 0.819% (54th percentile) indicates moderate probability of exploitation activity within the next 30 days.

Root Cause

The root cause is the lack of prepared statements or input sanitization in the query that handles the id parameter in edit_user.php. User-supplied data is trusted and interpolated directly into a SQL string, allowing syntactic modification of the intended query.

Attack Vector

The attack is executed remotely over HTTP against the vulnerable web application. An attacker submits a manipulated id parameter to edit_user.php containing SQL metacharacters and payloads. Because the exploit has been publicly disclosed, automated scanners and opportunistic attackers can weaponize it with minimal effort. Refer to the GitHub Vulnerability Report and VulDB #263924 for public exploit details.

Detection Methods for CVE-2024-4804

Indicators of Compromise

HTTP requests to edit_user.php containing SQL metacharacters in the id parameter, such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, /*).
Unusually long or URL-encoded id values in web server access logs.
Database error messages returned in HTTP responses, indicating query parsing failures.
Unexpected SELECT, UPDATE, or INFORMATION_SCHEMA queries originating from the application service account.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter of edit_user.php for SQL injection signatures.
Enable database query logging and alert on queries referencing INFORMATION_SCHEMA or system tables from the application account.
Correlate web server logs with database logs to identify suspicious request-to-query patterns.

Monitoring Recommendations

Monitor authentication events for the College Management System to identify credential misuse preceding exploitation attempts.
Track outbound connections from the database host to detect data exfiltration following successful injection.
Review access logs for repeated failed requests to edit_user.php from a single source, which may indicate blind SQL injection probing.

How to Mitigate CVE-2024-4804

Immediate Actions Required

Restrict network access to the College Management System administrative interface using firewall rules or VPN gating.
Rotate credentials for all accounts with access to the application, particularly administrative users.
Review database audit logs for suspicious queries against user, credential, or configuration tables dating back to May 2024.
Consider taking vulnerable instances offline until a vendor patch or code fix is applied.

Patch Information

No official vendor patch has been published in the referenced advisories. Administrators should contact Kashipara or review the VulDB entry #263924 for updates. Where source code access is available, replace direct concatenation in edit_user.php with parameterized queries or prepared statements, and apply strict server-side validation on the id parameter to accept only integer values.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads targeting the id parameter.
Enforce strict input validation at a reverse proxy layer, rejecting non-numeric id values before they reach the application.
Apply least-privilege permissions to the database account used by the application, removing write access to sensitive tables where feasible.
Disable or remove the edit_user.php endpoint if it is not required for operations.

bash

# Example nginx configuration to reject non-numeric id parameters
location /edit_user.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}