CVE-2024-4917: Campcodes Online Examination SQL Injection

CVE-2024-4917 Overview

CVE-2024-4917 is a SQL injection vulnerability in Campcodes Online Examination System 1.0. The flaw resides in the submitAnswerExe.php script, where the exmne_id parameter is passed directly into a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is tracked as VDB-264452 and has been publicly disclosed, including proof-of-concept documentation. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers with low-privilege access can execute arbitrary SQL queries against the backend database, potentially exposing exam content, student records, and credentials.

Affected Products

• Campcodes Online Examination System 1.0
• submitAnswerExe.php endpoint
• Deployments exposing the exmne_id parameter to untrusted input

Discovery Timeline

• 2024-05-15 - CVE-2024-4917 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-4917

Vulnerability Analysis

The vulnerability exists in the answer submission workflow of Campcodes Online Examination System 1.0. The submitAnswerExe.php script accepts the exmne_id argument from a client request and concatenates the value into a SQL statement without parameterization or input validation. An attacker authenticated as a low-privilege user can supply crafted input that breaks out of the intended query context. This enables UNION-based extraction, boolean-based blind retrieval, or time-based inference attacks against the underlying MySQL database.

The EPSS score is 0.247% (47.9 percentile), reflecting modest in-the-wild exploitation probability, but public exploit documentation lowers the practical barrier to attack.

Root Cause

The root cause is the absence of prepared statements or input sanitization for the exmne_id parameter inside submitAnswerExe.php. User-controlled data flows directly into a dynamically constructed SQL query, violating the principle of separating code from data.

Attack Vector

The attack vector is network-based and requires low privileges, typically a registered student or test-taker account. An attacker submits a tampered request to submitAnswerExe.php with malicious SQL syntax appended to the exmne_id value. Because the application echoes query results or exhibits observable timing differences, attackers can exfiltrate database contents, including user credentials and exam answers.

No authenticated PoC code is reproduced here; technical exploitation details are documented in the public advisory: GitHub Exploit Documentation.

Detection Methods for CVE-2024-4917

Indicators of Compromise

• HTTP POST or GET requests to submitAnswerExe.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, OR 1=1, or comment sequences (--, #) in the exmne_id parameter.
• Web server access logs showing unusually long exmne_id values or encoded payloads (%27, %20OR%20).
• Database error messages referencing MySQL syntax errors originating from the examination application.
• Unexpected outbound DNS lookups or file reads correlating with LOAD_FILE or INTO OUTFILE abuse.

Detection Strategies

• Deploy a web application firewall (WAF) rule set, such as OWASP CRS, that inspects request parameters for SQL injection signatures.
• Enable MySQL general query logging on the database backend and alert on queries against the exam tables containing tautologies or stacked statements.
• Implement runtime application self-protection (RASP) or database activity monitoring to flag deviations from baseline query templates.

Monitoring Recommendations

• Continuously monitor authentication logs for low-privilege accounts generating high volumes of requests to submitAnswerExe.php.
• Correlate web access logs with database error rates to identify blind SQL injection probing.
• Alert on any HTTP 500 responses or database timeouts triggered by the examination endpoints.

How to Mitigate CVE-2024-4917

Immediate Actions Required

• Restrict network access to the Online Examination System to trusted networks or VPN-authenticated users only.
• Disable or remove the submitAnswerExe.php endpoint until a verified patch is applied if the system is internet-exposed.
• Audit student and administrator accounts for unauthorized data access since May 2024.
• Rotate database credentials and any application secrets that may have been exposed.

Patch Information

No official vendor advisory or patch URL is listed in the NVD entry for CVE-2024-4917. Operators should monitor the Campcodes project for updates and review the public technical reference at VulDB #264452 for remediation guidance. Until an official fix is published, code maintainers should refactor submitAnswerExe.php to use parameterized queries via PHP Data Objects (PDO) or mysqli prepared statements.

Workarounds

• Apply server-side input validation that restricts exmne_id to numeric values only and rejects all other input.
• Deploy WAF rules that block SQL injection payloads targeting the exmne_id parameter.
• Run the database account used by the application with least privilege, denying FILE, CREATE, and DROP permissions.
• Place the application behind an authenticated reverse proxy to limit anonymous reconnaissance.

# Example ModSecurity rule to block SQLi attempts against exmne_id
SecRule ARGS:exmne_id "@detectSQLi" \
    "id:1004917,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2024-4917 SQLi attempt on submitAnswerExe.php',\
    logdata:'Matched data: %{MATCHED_VAR}'"