CVE-2024-5390: Online Student Enrollment System SQL Injection

CVE-2024-5390 Overview

CVE-2024-5390 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in the listofstudent.php script, where the lname parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The issue is tracked in VulDB as entry #266304 and maps to [CWE-89]. Public disclosure has occurred and technical details are available in the referenced advisories.

Critical Impact
Remote attackers with low-level privileges can inject SQL commands through the lname parameter in listofstudent.php, exposing enrollment data stored in the backend database.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: listofstudent.php
Vulnerable parameter: lname

Discovery Timeline

2024-05-27 - CVE-2024-5390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5390

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in a PHP web application. The listofstudent.php endpoint accepts an lname (last name) argument from user input and concatenates it into a SQL query executed against the backing database. Because the input is neither parameterized nor escaped, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation is performed remotely over the network. The attack requires low privileges but no user interaction, meaning any authenticated session with access to the affected endpoint can trigger the flaw. According to the CVSS 4.0 vector, confidentiality, integrity, and availability impacts on the vulnerable system are each rated low, reflecting scoped access to enrollment data rather than full database compromise.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application concatenates the lname HTTP parameter directly into a SQL statement without using prepared statements or input validation. Standard SQL metacharacters such as single quotes, comments, and UNION clauses are accepted verbatim by the query builder.

Attack Vector

An attacker sends a crafted HTTP request to listofstudent.php with a malicious payload in the lname parameter. Typical payloads use boolean-based, error-based, or UNION-based techniques to extract records from tables such as user accounts, enrollment records, or configuration data. Because the exploit has been publicly disclosed via the linked GitHub Issue Report and VulDB entry, opportunistic scanning against exposed installations is likely.

No verified proof-of-concept code is republished here. See the referenced advisories for technical payload details.

Detection Methods for CVE-2024-5390

Indicators of Compromise

HTTP requests to listofstudent.php containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in the lname parameter.
Web server access logs showing unusually long or URL-encoded lname values from a single source IP.
Database error messages returned to the client, indicating query parse failures triggered by injection attempts.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that match common SQL injection signatures against the lname query parameter.
Enable database query logging and alert on queries referencing student tables that contain tautologies (OR 1=1), stacked queries, or information_schema lookups.
Correlate authenticated session activity with anomalous query patterns to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Monitor outbound data volumes from the database server for spikes consistent with bulk record extraction.
Track repeated 500-series HTTP responses from listofstudent.php, which often accompany error-based SQL injection probing.
Alert on new or unusual user-agent strings accessing enrollment endpoints, particularly automated scanners such as sqlmap.

How to Mitigate CVE-2024-5390

Immediate Actions Required

Restrict network access to the Online Student Enrollment System to trusted internal networks or through a VPN until a patch is available.
Place the application behind a WAF configured with SQL injection rulesets covering the lname parameter and other user-controlled inputs.
Audit database accounts used by the application and enforce least privilege, removing DDL and administrative rights where unnecessary.

Patch Information

At the time of publication, no vendor advisory or official patch has been listed in the referenced sources for itsourcecode Online Student Enrollment System 1.0. Administrators should monitor the vendor site and the VulDB entry for updates. If no fix is forthcoming, consider migrating to a maintained enrollment platform.

Workarounds

Refactor the listofstudent.php query to use parameterized statements (PDO::prepare with bound parameters or mysqli prepared statements) instead of string concatenation.
Apply server-side input validation that rejects non-alphabetic characters in the lname field before it reaches the query layer.
Disable or remove listofstudent.php if the endpoint is not required for production operation.

bash

# Example WAF rule (ModSecurity) to block SQL metacharacters in the lname parameter
SecRule ARGS:lname "@rx (?i)(union\s+select|--|;|/\*|\bor\b\s+1=1|sleep\()" \
  "id:1005390,phase:2,deny,status:403,log,msg:'CVE-2024-5390 SQLi attempt in lname'"