CVE-2024-6732: Student Study Center Desk SQLi Vulnerability

CVE-2024-6732 Overview

CVE-2024-6732 is a SQL injection vulnerability in SourceCodester Student Study Center Desk Management System 1.0. The flaw resides in the /sscdms/classes/Users.php?f=save endpoint, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires low-privilege authentication. Public disclosure of exploit details has occurred, increasing exposure risk for internet-facing deployments. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can inject SQL statements via the id parameter in Users.php, potentially exposing or modifying database contents in the Student Study Center Desk Management System.

Affected Products

SourceCodester Student Study Center Desk Management System 1.0
Oretnom23 Student Study Center Desk Management System (vendor alias)
CPE: cpe:2.3:a:oretnom23:student_study_center_desk_management_system:1.0

Discovery Timeline

2024-07-14 - CVE-2024-6732 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6732

Vulnerability Analysis

The vulnerability exists in the save function handler within /sscdms/classes/Users.php. The application accepts the id parameter from the HTTP request and incorporates it directly into a SQL statement used for updating or saving user records. Because the parameter is not sanitized, parameterized, or type-cast, an attacker can break out of the intended query context.

Successful exploitation allows attackers to read arbitrary tables, modify records, or enumerate database schema. In the context of a study center management application, this exposes user credentials, session data, and administrative account information. The EPSS score of 0.618% reflects observed exploitation likelihood, and public exploit details are available through third-party vulnerability trackers.

Root Cause

The root cause is missing input validation and use of dynamic SQL construction in the save action of Users.php. The id parameter is concatenated into a query string rather than bound as a prepared statement parameter. This design flaw is consistent with [CWE-89] SQL injection weaknesses common in PHP applications that rely on manual query assembly instead of PDO or MySQLi prepared statements.

Attack Vector

An authenticated attacker sends a crafted HTTP POST request to /sscdms/classes/Users.php?f=save with a malicious payload in the id field. Standard SQL injection techniques such as UNION-based extraction, boolean-based blind injection, or time-based blind injection apply. No user interaction is required beyond the attacker's own request, and the attack originates over the network.

The vulnerability mechanism involves direct interpolation of the id parameter into a SQL statement. See the Kunull CVE Research Report and VulDB #271450 for reproduction details.

Detection Methods for CVE-2024-6732

Indicators of Compromise

HTTP requests to /sscdms/classes/Users.php?f=save containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or comment sequences (--, #) in the id parameter.
Unexpected database errors or long response times originating from the Users.php endpoint in web server logs.
New or modified administrative user records in the users table without a corresponding legitimate admin action.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the id parameter on /sscdms/classes/Users.php for SQL injection signatures.
Enable database query logging and alert on queries against the users table containing tautologies (OR 1=1), stacked queries, or INFORMATION_SCHEMA references.
Correlate authenticated session activity with anomalous parameter payload lengths or non-numeric values in the id field.

Monitoring Recommendations

Monitor web access logs for repeated POST requests to Users.php?f=save from the same source IP with varying id values.
Track authentication events and privilege changes in the application database to identify unauthorized escalation.
Alert on outbound database connections or data volumes that deviate from baseline query patterns.

How to Mitigate CVE-2024-6732

Immediate Actions Required

Restrict access to the Student Study Center Desk Management System behind a VPN or IP allowlist until a patched release is available.
Deploy WAF signatures blocking SQL injection patterns targeting the id parameter on /sscdms/classes/Users.php.
Rotate all application and database credentials, and audit the users table for unauthorized entries.

Patch Information

No official vendor patch is listed in the NVD entry or referenced advisories at the time of publication. SourceCodester and Oretnom23 have not published a fixed version for Student Study Center Desk Management System 1.0. Refer to the SourceCodester project page for future updates and consider replacing the application with an actively maintained alternative.

Workarounds

Modify Users.php to use PDO or MySQLi prepared statements with bound parameters for the id value, and enforce integer casting before query execution.
Apply least-privilege database accounts so the application user cannot read sensitive tables or execute DDL statements.
Remove or disable the affected endpoint if the save functionality is not required in production.

bash

# Example WAF rule (ModSecurity) blocking SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /sscdms/classes/Users.php" \
    "chain,phase:2,deny,status:403,id:1006732,msg:'CVE-2024-6732 SQLi attempt'"
    SecRule ARGS:id "@detectSQLi" "t:none,t:urlDecode,t:lowercase"