CVE-2024-6952: University Management System SQL Injection

CVE-2024-6952 Overview

CVE-2024-6952 is a SQL injection vulnerability in itsourcecode University Management System 1.0. The flaw resides in the /view_single_result.php endpoint, where the seme parameter is passed directly into a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely and requires only low-level privileges. Public disclosure of the exploit details has occurred, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked under VulDB identifier VDB-272074 and mapped to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers can extract, modify, or destroy database contents by injecting SQL through the seme parameter of /view_single_result.php.

Affected Products

Angeljudesuarez University Management System 1.0
itsourcecode University Management System distribution
Deployments referencing cpe:2.3:a:angeljudesuarez:university_management_system:1.0

Discovery Timeline

2024-07-21 - CVE-2024-6952 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6952

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the result-viewing component of the University Management System. The vulnerable endpoint accepts query parameters vr, vn, and seme, with the seme argument concatenated directly into an SQL query used to retrieve student result records. Because the application does not validate, escape, or bind this parameter, an attacker can break out of the intended query context and append their own SQL clauses. Successful exploitation exposes stored data such as student records, grades, and credentials. Impact spans confidentiality, integrity, and availability of the underlying database. The public disclosure of exploitation details lowers the technical barrier for attackers targeting exposed instances.

Root Cause

The root cause is the absence of parameterized queries and input validation in the PHP script handling the seme request parameter. Values received from the client are concatenated into an SQL statement without escaping or type checking, which matches the CWE-89 pattern.

Attack Vector

Exploitation occurs over the network against a reachable HTTP endpoint. An authenticated user with low privileges submits a crafted GET request to /view_single_result.php?vr=123321&vn=mirage&seme=<payload>. The injected payload alters the SQL query executed on the backend, enabling data extraction through UNION-based or boolean-based techniques, or destructive operations through stacked queries where supported.

No verified proof-of-concept code is included here. Technical details are available in the GitHub CVE Document and the VulDB entry #272074.

Detection Methods for CVE-2024-6952

Indicators of Compromise

HTTP requests to /view_single_result.php where the seme parameter contains SQL metacharacters such as ', ", --, ;, UNION, SELECT, SLEEP(, or information_schema.
Unexpected outbound database errors surfaced in HTTP responses referencing MySQL syntax.
Web server access logs showing repeated requests to view_single_result.php from a single source with varying seme values.
Database logs recording queries containing UNION SELECT or references to information_schema.tables originating from the application account.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the seme, vr, and vn parameters for SQL injection signatures.
Enable database query logging and alert on abnormal query structures issued by the University Management System's service account.
Use static analysis on the PHP source to identify unsanitized concatenation of $_GET['seme'] into SQL statements.

Monitoring Recommendations

Monitor authenticated session activity for a spike in requests to view_single_result.php from a single account.
Alert on HTTP 500 responses tied to database errors on result-viewing endpoints, which often signal injection probing.
Track outbound data volume from the database host to catch bulk extraction attempts.

How to Mitigate CVE-2024-6952

Immediate Actions Required

Restrict access to the University Management System behind a VPN or trusted network segment until a fix is applied.
Deploy WAF rules that reject requests to /view_single_result.php containing SQL metacharacters in the seme parameter.
Rotate database credentials used by the application and audit the database service account's privileges, removing DROP, ALTER, and FILE permissions where not required.
Review web server and database logs for prior exploitation attempts against the affected endpoint.

Patch Information

No official vendor patch is listed in the NVD or VulDB references at the time of writing. Operators should track the VulDB entry and the vendor project for updates. In the absence of a vendor fix, apply source-level remediation by replacing string concatenation with prepared statements using PDO or mysqli bound parameters, and add server-side type validation for seme, vr, and vn.

Workarounds

Modify view_single_result.php to cast the seme parameter to an expected type (for example, integer) before use.
Implement an allow-list of permitted values for seme and reject any input outside that list.
Disable the result-viewing feature until code-level fixes are in place if the endpoint is not business-critical.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the affected endpoint
SecRule REQUEST_URI "@beginsWith /view_single_result.php" \
  "chain,phase:2,deny,status:403,id:1006952,msg:'CVE-2024-6952 SQLi attempt'"
  SecRule ARGS:seme "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|--|;)" "t:none"