CVE-2024-5397: Online Student Enrollment System SQLi Flaw

CVE-2024-5397 Overview

CVE-2024-5397 is a SQL injection vulnerability in itsourcecode Online Student Enrollment System 1.0. The flaw resides in the instructorSubjects.php file, where the instructorId parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely and requires only low-privileged access. Public disclosure of the exploit technique has occurred through the VulDB entry VDB-266311, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact
Remote attackers with low privileges can inject arbitrary SQL commands through the instructorId parameter, exposing student enrollment data and potentially compromising database integrity.

Affected Products

itsourcecode Online Student Enrollment System 1.0
Component: instructorSubjects.php
Parameter: instructorId

Discovery Timeline

2024-05-27 - CVE-2024-5397 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5397

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] affecting the instructor subject listing functionality. The instructorSubjects.php script accepts an instructorId GET or POST parameter and concatenates it directly into a SQL query without parameterized statements or input validation. Attackers can append SQL operators, UNION clauses, or boolean-based payloads to extract records, enumerate database schemas, or manipulate stored data.

Because the Online Student Enrollment System stores student records, instructor assignments, and academic data, successful exploitation exposes personally identifiable information (PII). Depending on database user privileges, attackers may also achieve write access to enrollment records. The exploit has been publicly disclosed via VulDB submission #344700, lowering the barrier to weaponization.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The application accepts the instructorId value from an HTTP request and interpolates it directly into a database query string. No prepared statements, parameter binding, or type casting are applied. Standard PHP database APIs such as PDO or mysqli with bound parameters would prevent the flaw, but the affected code path uses direct string concatenation instead.

Attack Vector

The attack vector is network-based. An authenticated user with low privileges submits a crafted request to instructorSubjects.php with a malicious instructorId value. Typical payloads include tautologies such as 1 OR 1=1, UNION-based extractions like 1 UNION SELECT username,password FROM users, and time-based blind payloads using SLEEP(). Automated tools such as sqlmap can identify and exploit this endpoint with minimal configuration. See the GitHub issue report for the disclosed proof-of-concept details.

Detection Methods for CVE-2024-5397

Indicators of Compromise

Web server access logs containing requests to instructorSubjects.php with SQL metacharacters (single quotes, --, UNION, SELECT, SLEEP, OR 1=1) in the instructorId parameter
Unusually long or URL-encoded instructorId values in HTTP request logs
Database error messages returned in HTTP responses referencing MySQL syntax or table names
Spikes in query duration or CPU consumption on the backing MySQL/MariaDB instance

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the instructorId parameter for SQL injection patterns
Enable database query logging and alert on queries referencing sensitive tables from the enrollment application user
Monitor for authentication events followed immediately by anomalous requests to instructorSubjects.php

Monitoring Recommendations

Forward web server and database logs to a centralized SIEM for correlation and retention
Baseline normal request patterns for instructorSubjects.php and alert on deviations in parameter length or character set
Track outbound data volumes from the database server to detect bulk extraction attempts

How to Mitigate CVE-2024-5397

Immediate Actions Required

Restrict network exposure of the Online Student Enrollment System to trusted networks or VPN-accessible ranges only
Audit the instructorSubjects.php code path and replace string concatenation with parameterized queries using PDO or mysqli prepared statements
Apply least-privilege permissions to the database account used by the application, removing FILE, DROP, and administrative rights
Review recent web and database logs for signs of prior exploitation attempts against the affected endpoint

Patch Information

At the time of publication, itsourcecode has not released an official security patch for CVE-2024-5397. Refer to the VulDB entry #266311 and the VulDB CTI submission for updates on vendor remediation status. Organizations running this software should treat it as unmaintained and consider migrating to a supported enrollment platform.

Workarounds

Place the application behind a WAF configured with OWASP Core Rule Set to block common SQL injection payloads targeting instructorId
Implement server-side input validation that enforces instructorId as a numeric integer before it reaches any database query
Disable or remove the instructorSubjects.php endpoint if the instructor subject listing feature is not required
Isolate the database server on a private network segment with restrictive firewall rules limiting connections to the application host

bash

# Example nginx configuration to reject non-numeric instructorId values
location = /instructorSubjects.php {
    if ($arg_instructorId !~ ^[0-9]+$) {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}