CVE-2024-5378: School Attendance System SQLi Vulnerability

CVE-2024-5378 Overview

CVE-2024-5378 is a SQL injection vulnerability in SourceCodester School Intramurals - Student Attendance Management System 1.0, developed by oretnom23. The flaw resides in the /manage_sy.php script, where the id parameter is passed directly into a database query without sanitization. Attackers with low-privilege authenticated access can manipulate the id argument to execute arbitrary SQL statements remotely. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact

Remote attackers can extract, modify, or delete database contents through the unsanitized id parameter in /manage_sy.php, compromising student attendance records and administrative data.

Affected Products

• Oretnom23 School Intramurals - Student Attendance Management System 1.0
• File path: /manage_sy.php
• Vulnerable parameter: id

Discovery Timeline

• 2024-05-26 - CVE-2024-5378 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-5378

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input passed to a SQL query in /manage_sy.php. The id parameter is concatenated directly into a database statement, allowing attackers to inject arbitrary SQL syntax. This pattern is documented in the public proof-of-concept on GitHub and the VulDB Entry #266290.

Successful exploitation can disclose sensitive records, including student identifiers and attendance histories. Attackers can also leverage SQL injection to modify or destroy stored data. Depending on the underlying database privileges, the issue may enable further lateral movement within the database server.

Root Cause

The root cause is a failure to use parameterized queries or prepared statements when handling the id request parameter. User input is passed directly into the SQL query string without input validation, type casting, or escaping. This is a textbook instance of [CWE-89] and reflects insecure data-access practices common in legacy PHP applications.

Attack Vector

The attack is performed over the network against the vulnerable HTTP endpoint. An authenticated user with low privileges crafts a request to /manage_sy.php containing a malicious id value. The injected SQL payload is executed in the database context of the application. Because the exploit is public, automated scanners and opportunistic attackers can weaponize it against exposed deployments.

The vulnerability mechanism is described in prose because no verified exploitation code is available beyond the linked public disclosure. Refer to the GitHub CVE Documentation for the technical write-up.

Detection Methods for CVE-2024-5378

Indicators of Compromise

• HTTP requests to /manage_sy.php containing SQL meta-characters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #) in the id parameter.
• Database error messages referencing manage_sy.php in web server or PHP error logs.
• Unexpected SELECT, UNION, or INFORMATION_SCHEMA queries originating from the web application database user.

Detection Strategies

• Deploy web application firewall (WAF) rules to flag SQL injection patterns targeting the id parameter on /manage_sy.php.
• Enable database query logging and alert on queries containing UNION SELECT or references to information_schema from the application service account.
• Review web server access logs for anomalous query strings with encoded SQL syntax (e.g., %27, %20OR%20).

Monitoring Recommendations

• Correlate HTTP request patterns with database query telemetry to identify injection attempts in real time.
• Track authentication events for the application to detect credential abuse preceding injection attempts.
• Forward web and database logs to a centralized SIEM for retention and correlation across detection windows.

How to Mitigate CVE-2024-5378

Immediate Actions Required

• Restrict network access to the School Intramurals application until a patched version is available.
• Audit application accounts and revoke unnecessary privileges, since exploitation requires low-privilege authentication.
• Inspect web server and database logs for prior exploitation indicators against /manage_sy.php.

Patch Information

No official vendor patch has been published for CVE-2024-5378 as of the last NVD update on 2025-02-10. Administrators should monitor the VulDB Entry #266290 and the vendor's distribution channels for fix announcements. In the interim, apply source-level fixes by replacing string concatenation in /manage_sy.php with prepared statements using PDO or MySQLi parameter binding.

Workarounds

• Implement a WAF rule that blocks requests to /manage_sy.php where the id parameter contains non-numeric characters.
• Modify /manage_sy.php to cast id to an integer (e.g., intval($_GET['id'])) before use in SQL queries.
• Restrict the database account used by the application to read-only access on non-essential tables to limit injection impact.
• Place the application behind authentication-enforcing reverse proxies and limit access to trusted internal networks.

# Configuration example: WAF rule (ModSecurity) blocking SQLi on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /manage_sy.php" \
    "id:1005378,phase:2,deny,status:403,\
    chain,msg:'CVE-2024-5378 SQLi attempt on id parameter'"
    SecRule ARGS:id "!@rx ^[0-9]+$" \
        "t:none,t:urlDecodeUni"