CVE-2024-5103: School Management System SQLi Vulnerability

CVE-2024-5103 Overview

CVE-2024-5103 is a SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in the /view/student_first_payment.php script, where the grade parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements against the backing database. The vulnerability is remotely exploitable and requires only low-privileged authenticated access. Public disclosure of exploit details has occurred through third-party vulnerability documentation, increasing the risk of opportunistic attacks against exposed deployments. The issue is tracked as VDB-265093 and classified under [CWE-89].

Critical Impact
Remote authenticated attackers can execute arbitrary SQL queries through the grade parameter, enabling data theft, modification, or destruction of student records and financial payment data.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
Component: /view/student_first_payment.php
Vulnerable parameter: grade

Discovery Timeline

2024-05-19 - CVE-2024-5103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5103

Vulnerability Analysis

The vulnerability exists in the student_first_payment.php endpoint of Campcodes Complete Web-Based School Management System version 1.0. The script accepts a grade parameter through HTTP request input and concatenates it directly into a SQL query. Because no parameterized queries, prepared statements, or input escaping are used, attackers can break out of the intended query context and append their own SQL clauses. This maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The current EPSS score is 0.51%, reflecting a modest but non-trivial probability of exploitation in the near term.

Root Cause

The root cause is direct interpolation of untrusted user input into a SQL statement without validation or binding. The application trusts the grade request parameter and passes it into the query string used to look up student payment records. Standard defensive controls such as prepared statements with parameter binding, allowlist validation of expected values, and least-privilege database accounts are absent from the affected code path.

Attack Vector

The attack is executed over the network against the school management web application. An attacker with low-privilege access sends a crafted HTTP request to /view/student_first_payment.php with a malicious grade value. Typical payloads use UNION-based injection to exfiltrate data from other tables, boolean or time-based blind techniques to enumerate schema contents, or stacked queries where the database driver permits them. Successful exploitation can expose student personally identifiable information, payment records, staff credentials, and administrative session data. Full technical proof-of-concept details are documented in the GitHub Vulnerability Documentation and the VulDB CVE Analysis.

Detection Methods for CVE-2024-5103

Indicators of Compromise

HTTP requests to /view/student_first_payment.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the grade parameter.
Web server access logs showing unusually long or URL-encoded grade values from a single source IP.
Database error messages returned in HTTP responses referencing MySQL syntax errors tied to the grade field.
Unexpected outbound data transfers or spikes in database read volume from the application server.

Detection Strategies

Deploy web application firewall rules that inspect query and body parameters for SQL injection signatures targeting the grade field.
Enable database query logging and alert on multi-statement queries, UNION SELECT patterns, or information_schema access originating from the application user.
Correlate authentication events with abnormal request volumes to /view/student_first_payment.php to identify credential abuse tied to injection attempts.

Monitoring Recommendations

Forward web server, application, and MySQL logs to a centralized analytics platform for cross-source correlation.
Alert on HTTP 500 responses from the payment view endpoint, which often accompany failed injection probes.
Track baseline query patterns for the application service account and flag deviations such as access to unrelated tables.

How to Mitigate CVE-2024-5103

Immediate Actions Required

Restrict network access to the school management application using IP allowlists or VPN gating until a patched build is available.
Deploy WAF rules that block SQL injection payloads on the grade parameter of /view/student_first_payment.php.
Rotate database credentials and audit the application database account for excessive privileges.
Review web and database logs retroactively for evidence of exploitation attempts against the affected endpoint.

Patch Information

No vendor patch has been published in the referenced advisories. Operators should monitor Campcodes distribution channels for updated releases. Where source access is available, remediate the code by replacing string concatenation with parameterized queries using PDO or MySQLi prepared statements, and validate grade against an allowlist of expected values before use in any query.

Workarounds

Disable or remove the /view/student_first_payment.php endpoint if the payment feature is not required in the deployment.
Enforce least-privilege on the application's database account, removing rights such as FILE, DROP, and access to unrelated schemas.
Apply virtual patching at the reverse proxy or WAF layer to reject requests where the grade parameter contains SQL metacharacters.
Enable prepared-statement enforcement and disable multi-statement query support at the MySQL driver level where feasible.

bash

# Example ModSecurity rule to block SQLi against the vulnerable parameter
SecRule REQUEST_URI "@contains /view/student_first_payment.php" \
    "chain,phase:2,deny,status:403,id:1005103,\
    msg:'CVE-2024-5103 SQLi attempt on grade parameter'"
    SecRule ARGS:grade "@rx (?i)(union(\s|/\*)+select|--|;|'|\bor\b\s+1=1|sleep\s*\()" "t:none,t:urlDecodeUni"