CVE-2024-5106: School Management System SQL Injection Flaw

CVE-2024-5106 Overview

CVE-2024-5106 is a SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in /view/student_payment_details3.php, where the index parameter is passed unsanitized into a database query. Remote attackers can manipulate this argument to inject arbitrary SQL statements without local access. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is tracked as VulDB entry 265096 and maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote authenticated attackers can inject SQL statements through the index parameter, exposing student records, payment data, and other database contents.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
File: /view/student_payment_details3.php
Parameter: index

Discovery Timeline

2024-05-19 - CVE-2024-5106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5106

Vulnerability Analysis

The vulnerability affects the payment details view module of the school management application. The index request parameter flows directly into a SQL query executed against the backend database. Because the application does not use parameterized queries or apply input sanitization, attackers can append SQL syntax to alter query logic.

Successful exploitation permits data extraction from any table accessible to the database user. Depending on the deployed database privileges, attackers may also write to tables or execute stacked queries. The attack occurs over the network and does not require user interaction.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL statement construction (CWE-89). The application concatenates the index parameter directly into the SQL query string rather than binding it as a parameter. This pattern is common in legacy PHP applications that use mysqli_query or mysql_query with string interpolation.

Attack Vector

Exploitation requires network access to the web application and low-privilege authentication. An attacker crafts an HTTP request to /view/student_payment_details3.php with a malicious index value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based blind injection payloads. The manipulated query returns attacker-controlled data or allows enumeration of database schema and contents.

The vulnerability mechanism follows the classic PHP SQL injection pattern: a $_GET['index'] value is embedded into a SELECT statement without escaping. Details of the proof-of-concept are documented in the GitHub Vulnerability Report and the VulDB CVE Analysis #265096.

Detection Methods for CVE-2024-5106

Indicators of Compromise

HTTP requests to /view/student_payment_details3.php containing SQL metacharacters in the index parameter, such as ', --, UNION, SELECT, or SLEEP(.
Web server or application logs showing unusually long index values or encoded payloads (%27, %20UNION%20).
Database error messages returned in HTTP responses referencing MySQL syntax errors.
Sudden spikes in SELECT query volume or long-running queries against the student payment tables.

Detection Strategies

Deploy a web application firewall (WAF) with SQL injection signatures tuned for PHP applications.
Enable database query logging and alert on queries containing tautologies (OR 1=1), stacked statements, or INFORMATION_SCHEMA access from the application account.
Correlate authenticated session activity with anomalous parameter values in reverse proxy or CDN logs.

Monitoring Recommendations

Monitor the /view/ directory endpoints for repeated 500-series responses that may indicate injection probing.
Track outbound data volume from the database server to identify potential exfiltration.
Ingest web and database logs into a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2024-5106

Immediate Actions Required

Restrict access to the school management application to trusted networks or VPN users until a fix is available.
Audit the database account used by the application and remove unnecessary privileges such as FILE, CREATE, or DROP.
Review web and database logs for prior exploitation attempts targeting /view/student_payment_details3.php.
Rotate credentials and session tokens if evidence of compromise is found.

Patch Information

No vendor patch has been published for Campcodes Complete Web-Based School Management System 1.0 at the time of NVD publication. Organizations running this application should evaluate whether continued use is acceptable and consider migrating to a supported platform. Consult the VulDB entry #265096 for status updates.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads targeting the index parameter.
Modify the vulnerable PHP code to use prepared statements with mysqli or PDO parameter binding instead of string concatenation.
Enforce input validation that restricts index to expected numeric values and rejects non-integer input.
Disable verbose database error output in production so injection probes do not receive schema information.

bash

# Example nginx location block to restrict access to the vulnerable endpoint
location /view/student_payment_details3.php {
    allow 10.0.0.0/8;
    deny all;
}