CVE-2024-5104: Campcodes School Management SQL Injection

CVE-2024-5104 Overview

CVE-2024-5104 is a SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in /view/student_grade_wise.php, where the grade parameter is passed to a database query without proper sanitization. Authenticated remote attackers can manipulate the parameter to inject arbitrary SQL statements. The issue is tracked as VulDB identifier VDB-265094 and maps to CWE-89. A public proof-of-concept has been disclosed, increasing exposure for unpatched deployments. This vulnerability affects a PHP-based school administration application typically deployed in educational environments.

Critical Impact
Remote attackers with low-privileged access can execute arbitrary SQL queries against the backend database, leading to unauthorized read and modification of student records, credentials, and administrative data.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
PHP application component /view/student_grade_wise.php
Deployments exposing the grade HTTP parameter to untrusted input

Discovery Timeline

2024-05-19 - CVE-2024-5104 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5104

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] affecting the student_grade_wise.php endpoint. The application accepts a grade argument through HTTP request parameters and concatenates it directly into a SQL query executed against the backend database. Because the input is not parameterized or sanitized, attackers can break out of the intended query context. This enables execution of attacker-controlled SQL statements against the application database. The attack is network-reachable and requires only low-level authentication, making mass exploitation feasible against internet-exposed instances. A public proof-of-concept has been published, lowering the barrier to exploitation.

Root Cause

The root cause is improper neutralization of special elements in the grade parameter before it is used in a SQL statement. The PHP code lacks prepared statements, parameterized queries, and input validation. String concatenation of user-controlled input into SQL commands allows attackers to alter query logic, append UNION SELECT clauses, or terminate statements to execute additional queries.

Attack Vector

An attacker sends a crafted HTTP request to /view/student_grade_wise.php with a malicious value in the grade parameter. Payloads typically include SQL metacharacters such as single quotes, comment markers, and boolean or union-based injection primitives. The attack requires network access to the web application and low-privileged credentials. Successful exploitation returns database content in HTTP responses or triggers time-based responses, enabling exfiltration of usernames, password hashes, grades, and administrative records.

No verified exploit code is reproduced here. See the GitHub PoC Document for the published proof-of-concept details.

Detection Methods for CVE-2024-5104

Indicators of Compromise

HTTP requests to /view/student_grade_wise.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the grade parameter
Web server logs showing repeated requests to student_grade_wise.php with abnormally long or URL-encoded grade values
Database error messages returned in HTTP responses, indicating parser failures caused by injected syntax
Unusual outbound traffic from the web server or database host following suspicious requests

Detection Strategies

Deploy web application firewall rules that flag SQL injection signatures on requests to the affected endpoint
Enable verbose access logging on the web server and correlate the grade parameter values against known injection patterns
Instrument the database with query auditing to identify anomalous UNION, INFORMATION_SCHEMA, or stacked queries originating from the application user

Monitoring Recommendations

Alert on HTTP 500 responses from /view/student_grade_wise.php, which often indicate malformed injection attempts
Monitor for spikes in request volume or parameter length against the affected PHP script
Track authentication events preceding suspicious requests, since exploitation requires a valid low-privileged session

How to Mitigate CVE-2024-5104

Immediate Actions Required

Restrict network access to the Campcodes Complete Web-Based School Management System to trusted networks or VPN users until a fix is applied
Place the application behind a web application firewall with SQL injection filtering enabled for the grade parameter
Review web and database logs for prior exploitation attempts using the indicators listed above
Rotate credentials and session tokens if evidence of database access is found

Patch Information

No vendor advisory or official patch is listed in the enriched CVE data. Consult the VulDB entry #265094 and monitor the vendor's channels for updates. Organizations should evaluate whether continued use of the affected version is acceptable given the public disclosure.

Workarounds

Modify the student_grade_wise.php source to use prepared statements with parameterized queries via PDO or mysqli bindings
Enforce server-side input validation on the grade parameter, restricting it to an allowlist of expected values
Apply the principle of least privilege to the database account used by the application, removing rights to INFORMATION_SCHEMA and administrative tables
Disable verbose SQL error messages in production to reduce information leakage during probing

bash

# Example: enforce parameterized query pattern in PHP
# Replace vulnerable concatenation such as:
#   $sql = "SELECT * FROM students WHERE grade = '".$_GET['grade']."'";
# With a parameterized query:
#   $stmt = $pdo->prepare("SELECT * FROM students WHERE grade = :grade");
#   $stmt->execute([':grade' => $_GET['grade']]);