CVE-2024-5394: Online Student Enrollment System SQLi Flaw

CVE-2024-5394 Overview

CVE-2024-5394 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in the newDept.php file, where the deptname parameter is passed directly into a database query without proper sanitization. Attackers can send crafted HTTP requests over the network to manipulate the underlying SQL statement. The vulnerability requires low-level privileges but no user interaction, and a public exploit disclosure has been published. The issue is tracked as VDB-266308 and classified under [CWE-89].

Critical Impact
Remote authenticated attackers can inject arbitrary SQL through the deptname parameter in newDept.php, leading to unauthorized access, modification, or exfiltration of student enrollment data.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: newDept.php
Parameter: deptname

Discovery Timeline

2024-05-27 - CVE-2024-5394 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5394

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] affecting the department management workflow of the Online Student Enrollment System. The newDept.php script accepts a deptname argument from the client and concatenates it into a SQL statement without parameterized queries or input validation. This allows an attacker to break out of the intended string context and append arbitrary SQL clauses.

Because the application is a PHP-based web system, exploitation only requires network reachability to the vulnerable endpoint and any authenticated session that can submit department creation requests. The publicly disclosed exploit lowers the barrier for opportunistic attackers scanning for exposed instances. EPSS data places the probability of exploitation at 0.614% (percentile 46.187).

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The deptname parameter is inserted directly into a query string, bypassing prepared statements. Meta-characters such as single quotes, semicolons, and SQL keywords are not escaped or filtered, allowing statement manipulation.

Attack Vector

The attack vector is network-based. An attacker with low privileges submits a POST or GET request to newDept.php containing a malicious deptname value. The payload can include UNION-based extraction, boolean-based blind conditions, or stacked queries depending on the database driver. Successful exploitation exposes underlying database contents including student records, credentials, and administrative data.

No verified exploit code is referenced in the advisory. Technical details are available in the GitHub issue report and VulDB entry #266308.

Detection Methods for CVE-2024-5394

Indicators of Compromise

HTTP requests to newDept.php containing SQL meta-characters such as ', --, ;, UNION, or SLEEP( in the deptname parameter.
Unexpected database errors or lengthy response times originating from department creation endpoints.
New or modified rows in the department table submitted from external IP addresses.
Web server access logs showing repeated POST requests to newDept.php from a single source.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the deptname parameter for SQL injection signatures.
Enable database query logging and alert on anomalous statements originating from the enrollment application's service account.
Correlate authentication events with subsequent newDept.php requests to identify low-privilege accounts issuing injection payloads.

Monitoring Recommendations

Monitor outbound database traffic for volume spikes or schema enumeration patterns.
Track HTTP 500 responses tied to newDept.php as potential indicators of failed injection attempts.
Baseline normal department creation activity to detect deviations in frequency or payload structure.

How to Mitigate CVE-2024-5394

Immediate Actions Required

Restrict access to the enrollment application to trusted networks or VPN users until a fix is applied.
Audit existing department records for entries containing suspicious characters or unexpected content.
Rotate database credentials used by the application if exposure is suspected.
Review authentication logs for accounts that may have abused low-privilege access to reach newDept.php.

Patch Information

At the time of publication, no vendor patch has been referenced in the advisory. Organizations running itsourcecode Online Student Enrollment System 1.0 should consult the vendor directly and monitor the VulDB entry for updates. Because the software is a small open-source PHP project, administrators may need to apply source-level fixes by replacing string-concatenated queries with prepared statements using PDO or MySQLi parameter binding.

Workarounds

Introduce server-side input validation that rejects deptname values containing SQL meta-characters or excessive length.
Deploy a WAF with signature-based SQL injection protection in front of the application.
Enforce least-privilege database accounts so the web application cannot read or modify tables outside its required scope.
Consider taking the vulnerable instance offline if it is exposed to untrusted networks and cannot be patched.

bash

# Example WAF rule concept (ModSecurity) blocking SQLi patterns in deptname
SecRule ARGS:deptname "@rx (?i)(union(\s+all)?\s+select|--|;|/\*|sleep\(|benchmark\()" \
  "id:1005394,phase:2,deny,status:403,msg:'CVE-2024-5394 SQLi attempt in deptname'"