CVE-2024-58276: Enrollment System SQL Injection Flaw

CVE-2024-58276 Overview

CVE-2024-58276 is a SQL injection vulnerability in Obi08/Enrollment System 1.0. The flaw resides in the keyword parameter of /get_subject.php and accepts unsanitized input directly into a SQL query. Unauthenticated attackers can issue UNION-based payloads to read arbitrary data from the backend database. Public reporting demonstrates extraction of records from the users table, including usernames and password values. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can exfiltrate credentials and other database contents through UNION-based SQL injection against /get_subject.php.

Affected Products

Obi08 Enrollment System 1.0
/get_subject.php endpoint (keyword parameter)
Deployments referencing the GitHub Enrollment System Repository

Discovery Timeline

2025-12-04 - CVE-2024-58276 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-58276

Vulnerability Analysis

The Enrollment System concatenates the HTTP keyword request parameter directly into a SQL statement executed by /get_subject.php. Because the application does not use parameterized queries or input validation, attackers can break out of the intended query context and append arbitrary SQL clauses. UNION-based injection allows the attacker to merge results from other tables into the response returned by the subject lookup. The attack requires no authentication, no user interaction, and works over the network against any reachable instance.

Root Cause

The root cause is unsafe construction of SQL queries from untrusted user input. The keyword parameter flows from the HTTP request into the database driver without prepared statements, escaping, or allow-list filtering. This pattern matches the [CWE-89] classification and is consistent with the analysis in the VulnCheck Advisory on SQL Injection.

Attack Vector

An attacker sends a crafted HTTP request to /get_subject.php with a malicious keyword value containing SQL metacharacters and a UNION SELECT clause. The application reflects merged query results back to the requester, enabling enumeration of database schema, table contents, and stored credentials. A public proof of concept is referenced in Exploit-DB #51845.

The vulnerability is exploitable in prose terms as follows: the attacker supplies a keyword value that terminates the original query, appends a UNION SELECT statement targeting the users table, and reads the response body to obtain username and password fields. No authentication state, session token, or CSRF token is required to reach the vulnerable code path.

Detection Methods for CVE-2024-58276

Indicators of Compromise

HTTP requests to /get_subject.php containing SQL keywords such as UNION, SELECT, --, 0x, or information_schema in the keyword parameter.
Web server access logs showing unusually long keyword values or URL-encoded SQL syntax (%27, %20UNION%20).
Database query logs containing UNION SELECT statements originating from the subject lookup code path.
Outbound responses from /get_subject.php whose size or row count deviates significantly from baseline subject queries.

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters and UNION/SELECT tokens in the keyword parameter.
Correlate web access logs with database audit logs to identify queries against the users table triggered by the subject endpoint.
Hunt for credential enumeration patterns by alerting when a single client IP issues many requests to /get_subject.php with varying payloads.

Monitoring Recommendations

Enable verbose query logging on the backing MySQL or MariaDB instance and forward logs to a centralized analytics platform.
Monitor for anomalous response sizes on the /get_subject.php endpoint, which typically indicates data exfiltration through UNION injection.
Track failed and successful login attempts following suspicious /get_subject.php traffic, since stolen credentials are likely to be reused against the login form.

How to Mitigate CVE-2024-58276

Immediate Actions Required

Take the Obi08 Enrollment System 1.0 instance offline or restrict it to trusted networks until remediation is complete.
Rotate all user passwords stored in the application database and invalidate active sessions.
Audit the users table and related tables for unauthorized inserts, updates, or privilege changes.
Place the application behind a web application firewall with SQL injection rules tuned for the keyword parameter.

Patch Information

No official vendor patch has been published in the references available for CVE-2024-58276. The project is hosted at the GitHub Enrollment System Repository, and operators should monitor the repository for fixes. Until a vendor patch is released, organizations must apply code-level fixes locally by replacing string concatenation in /get_subject.php with parameterized queries using PDO or mysqli prepared statements, and by validating that keyword contains only expected characters.

Workarounds

Modify /get_subject.php to use prepared statements with bound parameters for the keyword value.
Apply a server-side allow-list that restricts the keyword parameter to alphanumeric characters and a limited set of punctuation.
Configure the database account used by the application with least privilege so it cannot read the users table from the subject lookup context.
Block requests to /get_subject.php containing SQL metacharacters at the reverse proxy or WAF layer.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /get_subject.php" \
    "id:1058276,phase:2,deny,status:403,\
    chain,msg:'CVE-2024-58276 SQLi attempt on keyword parameter'"
    SecRule ARGS:keyword "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|--|0x[0-9a-f]+|\bor\b\s+1=1)" "t:none,t:urlDecodeUni"