CVE-2024-6731: Student Study Center Desk Management SQLI

CVE-2024-6731 Overview

CVE-2024-6731 is a SQL injection vulnerability affecting SourceCodester Student Study Center Desk Management System 1.0, developed by oretnom23. The flaw resides in the /Master.php?f=save_student endpoint, where the id parameter is not properly sanitized before being used in a database query. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter to read, modify, or delete records in the underlying database.

Affected Products

SourceCodester Student Study Center Desk Management System 1.0
Vendor: oretnom23
Vulnerable component: /Master.php?f=save_student (parameter id)

Discovery Timeline

2024-07-14 - CVE-2024-6731 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6731

Vulnerability Analysis

The Student Study Center Desk Management System uses PHP handlers dispatched through /Master.php with a query-string action selector (f=save_student). The save_student handler consumes the id parameter from client input and concatenates it directly into a SQL statement without parameterization or type enforcement. This allows an attacker to break out of the intended query context and append arbitrary SQL. Because the application accepts the request over the network and requires only low-privileged access, the attack surface extends to any user who can authenticate against the deployment.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in the save_student action of Master.php. User-supplied data flows into a dynamically constructed SQL query, satisfying the classic conditions for CWE-89. No allowlist validation, type casting, or parameter binding is applied to the id argument prior to query execution.

Attack Vector

Exploitation occurs over the network against the application's HTTP interface. An attacker submits a crafted request to /Master.php?f=save_student with a malicious payload in the id parameter. Depending on the underlying database, the injected SQL can be used to enumerate schema information, extract stored student and administrative records, modify data, or in some configurations pivot toward authentication bypass. Public disclosure of the exploit lowers the barrier for automated scanning and mass exploitation. See the Kunull CVE Research Report and the VulDB entry for further technical context.

Detection Methods for CVE-2024-6731

Indicators of Compromise

HTTP requests to /Master.php?f=save_student containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the id parameter.
Database errors or 500-series responses correlated with requests to the save_student endpoint.
Unexpected rows added, modified, or deleted in the student records table.
Web server logs showing repeated automated requests to Master.php from a single source IP.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter for SQL injection patterns on the save_student action.
Enable database query auditing to flag unparameterized or anomalous queries originating from the application user.
Correlate application error logs with access logs to surface probing behavior against Master.php.

Monitoring Recommendations

Alert on HTTP requests to /Master.php where query parameters contain SQL keywords or comment sequences.
Monitor for spikes in 4xx/5xx responses tied to the save_student handler.
Track outbound connections from the database host that could indicate post-exploitation data exfiltration.

How to Mitigate CVE-2024-6731

Immediate Actions Required

Restrict network exposure of the Student Study Center Desk Management System to trusted networks or place it behind an authenticated VPN.
Deploy WAF signatures that block SQL injection payloads targeting Master.php parameters.
Rotate database credentials and audit the students table for signs of unauthorized modification.
Review application and database logs for prior exploitation attempts against /Master.php?f=save_student.

Patch Information

No official vendor patch is listed in the referenced advisories at the time of publication. Organizations running version 1.0 should treat this application as unmaintained for security purposes and consider decommissioning it or replacing it with a maintained alternative. Consult the SourceCodester project page for any subsequent updates.

Workarounds

Modify the save_student handler in Master.php to use parameterized queries or prepared statements with type-bound parameters.
Enforce strict server-side input validation, restricting the id parameter to integer values only.
Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and cross-database privileges.
Add a reverse proxy rule to reject requests where the id parameter contains non-numeric characters.

bash

# Example nginx rule to reject non-numeric id values on the vulnerable endpoint
location = /Master.php {
    if ($arg_f = "save_student") {
        if ($arg_id !~ "^[0-9]+$") {
            return 400;
        }
    }
}