CVE-2024-5392: Online Student Enrollment System SQLi Flaw

CVE-2024-5392 Overview

CVE-2024-5392 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in the editSubject.php file, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The vulnerability is remotely exploitable and requires only low-privilege authentication. Exploit details have been publicly disclosed through VulDB entry #266306, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Remote attackers with low-privilege access can extract, modify, or delete database contents through crafted id parameter values sent to editSubject.php.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: editSubject.php
CPE: cpe:2.3:a:itsourcecode:online_student_enrollment_system:1.0

Discovery Timeline

2024-05-27 - CVE-2024-5392 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5392

Vulnerability Analysis

The vulnerability exists in the editSubject.php script of the Online Student Enrollment System 1.0. The script accepts a user-supplied id argument and incorporates it directly into an SQL query without parameterization or input filtering. An attacker submits crafted values through the id parameter to alter the intended query logic.

Successful exploitation allows arbitrary SQL execution against the backend database. This can result in disclosure of enrolled student records, tampering with subject and enrollment data, or authentication bypass through UNION-based or boolean-based injection techniques. The public disclosure of exploitation details in the GitHub issue tracker and VulDB removes the barrier for attackers seeking to weaponize the flaw.

Root Cause

The root cause is missing input validation and the absence of prepared statements when constructing the SQL query in editSubject.php. The application concatenates the raw id parameter into the query string, allowing SQL syntax injection. This pattern falls under CWE-89.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An authenticated user with low-privilege access to the application sends a modified request targeting editSubject.php with a malicious id parameter. No user interaction beyond the attacker's own request is required. Refer to the GitHub Issue Report and VulDB entry #266306 for reproduction context.

Detection Methods for CVE-2024-5392

Indicators of Compromise

HTTP requests to editSubject.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, --, or /* sequences in the id parameter.
Web server access logs showing unusually long id values or hex-encoded payloads targeting the enrollment application.
Database error messages returned in application responses indicating malformed queries originating from editSubject.php.
Unexpected outbound data volumes from the database server correlating with requests to the vulnerable endpoint.

Detection Strategies

Deploy a Web Application Firewall (WAF) with SQL injection signatures targeting the id query parameter path pattern.
Enable database query logging and alert on statements referencing tables outside the normal enrollment workflow.
Perform authenticated dynamic application security testing (DAST) against editSubject.php to confirm exposure.
Correlate authentication events with anomalous parameter values to detect low-privileged accounts abusing the endpoint.

Monitoring Recommendations

Monitor for repeated 500-series HTTP responses from editSubject.php, which often accompany injection probing.
Alert on any occurrence of SQL keywords in URL parameters within web access logs.
Baseline normal query patterns from the application user account and flag deviations such as INFORMATION_SCHEMA access.

How to Mitigate CVE-2024-5392

Immediate Actions Required

Restrict network exposure of the Online Student Enrollment System by placing it behind a VPN or IP allowlist until remediation is applied.
Disable or remove the editSubject.php endpoint if the functionality is not required in production.
Rotate credentials for the database account used by the application and enforce least privilege on that account.
Review web and database logs for prior exploitation attempts against the vulnerable parameter.

Patch Information

No official vendor patch is referenced in the available advisory data. Administrators should contact itsourcecode directly and consult the VulDB entry #266306 and the GitHub Issue Report for the latest remediation status. Where source code access exists, replace concatenated SQL with parameterized queries or prepared statements and enforce server-side integer validation on the id parameter.

Workarounds

Deploy WAF rules that block SQL metacharacters and keywords in the id parameter for requests to editSubject.php.
Enforce type casting to integer on the id parameter within a reverse proxy or application gateway before the request reaches the application.
Apply database-level restrictions preventing the application user from executing DROP, ALTER, or cross-schema SELECT operations.
Consider replacing the application with a maintained alternative if the vendor does not release a patch.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains editSubject.php" \
  "chain,id:1005392,phase:2,deny,status:403,msg:'CVE-2024-5392 SQLi attempt'"
  SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"