CVE-2024-4915: Campcodes Online Examination SQL Injection

CVE-2024-4915 Overview

CVE-2024-4915 is a SQL injection vulnerability in Campcodes Online Examination System 1.0. The flaw resides in the result.php script, where the id parameter is passed directly into a database query without proper sanitization. Attackers can manipulate the id argument remotely to inject arbitrary SQL statements. The vulnerability was assigned VulDB identifier VDB-264450 and is tracked under [CWE-89]. Public exploit details have been disclosed, lowering the barrier for opportunistic exploitation against unpatched deployments.

Critical Impact

Remote attackers with low privileges can inject SQL through the id parameter of result.php, leading to unauthorized data access in the examination system database.

Affected Products

• Campcodes Online Examination System 1.0
• Deployments exposing result.php to untrusted networks
• Installations without input validation patches applied

Discovery Timeline

• 2024-05-15 - CVE-2024-4915 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-4915

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw classified under [CWE-89]. The result.php endpoint accepts an id parameter via HTTP request and concatenates the value into a backend SQL query without parameterization or input validation. An authenticated attacker with low privileges can submit crafted payloads through this parameter to alter query logic.

Successful exploitation allows extraction of arbitrary data from the examination database, including user credentials, exam questions, and student records. Because the attack vector is network-based and complexity is low, exploitation can be automated against exposed instances. The disclosure of exploitation details publicly increases the likelihood of scanning and opportunistic attacks.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The application directly interpolates the user-supplied id value into a SQL statement rather than using prepared statements or parameterized queries. No allowlist validation or type coercion is applied to the input before it reaches the database layer.

Attack Vector

The attacker sends an HTTP request to result.php with a manipulated id parameter containing SQL syntax. Because the parameter value is concatenated into the query, the injected clauses execute against the backend MySQL database. The attack requires only low-level authenticated access and no user interaction. Full technical details are documented in the GitHub SQL Injection writeup and the VulDB #264450 entry.

Detection Methods for CVE-2024-4915

Indicators of Compromise

• HTTP requests to result.php containing SQL metacharacters such as single quotes, UNION, SELECT, or -- in the id parameter
• Web server logs showing unusually long or encoded values in the id query string
• Database error messages returned in HTTP responses originating from result.php

Detection Strategies

• Inspect web server access logs for anomalous id parameter values directed at result.php
• Deploy a web application firewall with SQL injection signatures covering boolean-based, union-based, and time-based payloads
• Correlate database query errors with corresponding HTTP requests to identify injection probes

Monitoring Recommendations

• Alert on repeated 500-level responses from result.php indicating malformed SQL execution
• Monitor outbound database query volumes for spikes consistent with data exfiltration
• Track authenticated user sessions issuing unexpected query patterns against the examination database

How to Mitigate CVE-2024-4915

Immediate Actions Required

• Restrict network access to the Online Examination System to trusted networks until a fix is applied
• Audit result.php and apply parameterized queries or prepared statements for the id parameter
• Review database logs for evidence of prior exploitation attempts referencing result.php

Patch Information

No vendor advisory or official patch has been published by Campcodes at the time of NVD listing. Administrators should consider source-level remediation by replacing dynamic SQL concatenation with parameterized queries using PDO or mysqli prepared statements. Refer to the VulDB entry for ongoing tracking of remediation status.

Workarounds

• Place the application behind a web application firewall configured with strict SQL injection rules
• Enforce server-side input validation requiring id to be a numeric integer before query execution
• Apply least-privilege database accounts so the application cannot read tables beyond its functional scope

# Example input validation hardening in PHP for the id parameter
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    http_response_code(400);
    exit('Invalid identifier');
}
$stmt = $pdo->prepare('SELECT * FROM results WHERE id = :id');
$stmt->execute([':id' => $id]);