CVE-2024-5120: Event Registration System SQLi Vulnerability

CVE-2024-5120 Overview

CVE-2024-5120 is a SQL injection vulnerability in SourceCodester Event Registration System 1.0, developed by oretnom23. The flaw resides in the /registrar/?page=registration endpoint, where the e parameter is incorporated into a database query without proper sanitization. Remote attackers with low-privileged access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed through VulDB (VDB-265200) and a detailed GitHub report, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact

Authenticated remote attackers can inject SQL queries through the e parameter to read, modify, or extract data from the application's backend database.

Affected Products

• SourceCodester Event Registration System 1.0
• oretnom23 event_registration_system package (CPE: cpe:2.3:a:oretnom23:event_registration_system:1.0)
• Deployments exposing the /registrar/?page=registration endpoint

Discovery Timeline

• 2024-05-20 - CVE-2024-5120 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-5120

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. The application accepts the e parameter from HTTP requests targeting /registrar/?page=registration and concatenates the value into a SQL statement without parameterized queries or input validation. An attacker can submit crafted input that breaks out of the intended query context and appends arbitrary SQL clauses.

Because the application is a registration platform, the database commonly holds attendee personal information, credentials, and event records. Successful injection can expose this data, modify records, or chain into further compromise through techniques such as UNION-based extraction or stacked queries depending on the backend driver.

The attack requires network access and low privileges. No user interaction is needed, and the exploit is published, lowering the technical barrier for opportunistic attackers scanning for vulnerable PHP-based registration applications.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The e GET parameter is passed directly to a query builder or string-formatted SQL statement. Prepared statements with bound parameters are not used, and no allow-list validation is applied to the input.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted request such as GET /registrar/?page=registration&e=<payload> where <payload> contains SQL meta-characters. The injected SQL executes within the database context of the application's service account. Refer to the GitHub SQL Injection Report and VulDB #265200 for technical reproduction details.

Detection Methods for CVE-2024-5120

Indicators of Compromise

• HTTP requests to /registrar/?page=registration containing SQL meta-characters in the e parameter, such as single quotes, UNION SELECT, --, /*, or SLEEP(.
• Web server access logs showing unusually long or encoded values in the e query string parameter.
• Database error messages or stack traces returned in HTTP responses originating from the registration endpoint.
• Unexpected SELECT, UPDATE, or INFORMATION_SCHEMA queries in MySQL/MariaDB query logs tied to the application user.

Detection Strategies

• Deploy web application firewall (WAF) rules to flag SQL injection patterns targeting the e parameter on the /registrar/ path.
• Enable database query logging and alert on INFORMATION_SCHEMA, LOAD_FILE, or BENCHMARK calls from the application service account.
• Correlate web access logs with database events to identify time-based blind injection patterns showing repeated requests with incremental delays.

Monitoring Recommendations

• Monitor outbound traffic from the web server for unusual data transfers indicating database exfiltration.
• Track HTTP 500 response rates and database error frequency on registration pages.
• Audit administrative accounts and registration records regularly for unauthorized modifications.

How to Mitigate CVE-2024-5120

Immediate Actions Required

• Restrict public access to the Event Registration System until a fix is applied, using network ACLs or authentication gateways.
• Deploy WAF signatures blocking SQL injection payloads in the e parameter and across the /registrar/ path.
• Review database logs and registration records for indicators of prior exploitation.
• Rotate database credentials and any administrative passwords stored within the application database.

Patch Information

No official vendor patch is referenced in the NVD entry or VulDB submission. SourceCodester Event Registration System 1.0 remains the only listed affected version. Administrators should track the VulDB CTI ID #265200 entry for vendor updates and consider replacing the application with a maintained alternative.

Workarounds

• Modify the vulnerable source to use prepared statements with bound parameters for all queries built from the e parameter.
• Add server-side input validation enforcing a strict allow-list (such as numeric IDs only) for the e parameter before it reaches database logic.
• Run the application database under a least-privilege account that cannot read system tables or execute administrative SQL.
• Place the application behind an authenticated reverse proxy to limit exposure to trusted users only.