CVE-2024-5393: Online Student Enrollment System SQLi Flaw

CVE-2024-5393 Overview

CVE-2024-5393 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in listofcourse.php, where the idno parameter is passed to a backend SQL query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements against the application database.

The issue is tracked under VulDB identifier VDB-266307 and is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A public disclosure describing the attack has been released.

Critical Impact
Remote attackers with low privileges can inject SQL statements through the idno parameter in listofcourse.php, leading to unauthorized read and write access to the enrollment database.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: listofcourse.php
Vulnerable parameter: idno

Discovery Timeline

2024-05-27 - CVE-2024-5393 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5393

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the listofcourse.php script of the Online Student Enrollment System. The application accepts the idno argument from an HTTP request and concatenates it directly into a SQL query. Because no parameterization or input validation is applied, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access to the web application and low-level authenticated privileges, per the CVSS 4.0 vector. No user interaction is required. Successful exploitation can expose stored student records, modify enrollment data, or reveal database schema information depending on the executed payload.

Root Cause

The root cause is the direct concatenation of untrusted user input into a SQL statement inside listofcourse.php. The application does not use prepared statements or parameterized queries, and it does not enforce a numeric type check on the idno argument before passing it to the database driver.

Attack Vector

An attacker sends a crafted HTTP request to listofcourse.php with a malicious idno value. The value contains SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads. The database executes the injected clause in the same context as the application's database user. See the GitHub Issue Report and VulDB entry #266307 for the original disclosure details.

No verified exploit code is included here. A public proof of concept is referenced in the disclosure.

Detection Methods for CVE-2024-5393

Indicators of Compromise

HTTP requests to listofcourse.php where the idno parameter contains SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP(.
Unusual database errors or long response times originating from queries against the course listing endpoint.
Web server access logs showing repeated requests to listofcourse.php from a single source with varying idno values.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the idno parameter for known SQL injection payload patterns.
Enable database query logging and alert on queries against the enrollment tables that contain tautologies, UNION operators, or time-based functions.
Correlate web access logs with database logs to identify request patterns that produce anomalous query structures.

Monitoring Recommendations

Monitor authentication and session logs for accounts that access listofcourse.php at atypical rates or times.
Alert on egress traffic from the database host that deviates from established baselines, which may indicate data exfiltration.
Track HTTP 500 responses and database error signatures returned from the enrollment application.

How to Mitigate CVE-2024-5393

Immediate Actions Required

Restrict network access to the Online Student Enrollment System 1.0 deployment until a vendor patch is available.
Place the application behind a WAF configured to block SQL injection payloads targeting the idno parameter.
Rotate database credentials used by the application and review the account for least-privilege scope.
Audit database contents and access logs for evidence of unauthorized reads or modifications since exposure began.

Patch Information

No vendor advisory or official patch is listed in the NVD references or vendor resources at the time of writing. Administrators should monitor the itsourcecode project pages and the VulDB CTI indicator for updates. If no patch is released, replace or refactor listofcourse.php to use parameterized queries.

Workarounds

Modify listofcourse.php to cast idno to an integer before use, or bind it as a typed parameter with PDO or mysqli prepared statements.
Apply an allowlist on the idno parameter that accepts only digits and rejects any request containing non-numeric characters.
Configure the application database user with read-only access where write access is not required for the course listing view.
Disable or remove the listofcourse.php endpoint if the functionality is not required in production.

bash

# Example ModSecurity rule to block SQL metacharacters in the idno parameter
SecRule ARGS:idno "@rx [^0-9]" \
    "id:1005393,phase:2,deny,status:403,\
    msg:'CVE-2024-5393: Non-numeric idno parameter blocked',\
    tag:'attack-sqli',tag:'CVE-2024-5393'"