CVE-2024-7165: School Fees Payment System SQLi Flaw

CVE-2024-7165 Overview

CVE-2024-7165 is a SQL injection vulnerability in SourceCodester School Fees Payment System 1.0, developed by oretnom23. The flaw resides in the /view_payment.php script, where the ef_id parameter is passed directly into a database query without proper sanitization. Remote attackers can exploit this weakness to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. The vulnerability is tracked as VDB-272579 and mapped to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote attackers with low privileges can manipulate the ef_id parameter to read, modify, or delete records in the underlying database of the School Fees Payment System.

Affected Products

SourceCodester School Fees Payment System 1.0
Vendor: oretnom23
CPE: cpe:2.3:a:oretnom23:school_fees_payment_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-07-28 - CVE-2024-7165 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7165

Vulnerability Analysis

The vulnerability affects the view_payment.php endpoint of the School Fees Payment System. The application accepts the ef_id HTTP request parameter and incorporates it directly into a SQL query used to retrieve payment records. Because the input is neither validated nor parameterized, attacker-controlled SQL syntax reaches the database engine.

An authenticated user with low privileges can trigger the flaw remotely over the network without user interaction. Exploitation allows the attacker to break out of the intended query structure and append arbitrary clauses. The public disclosure of proof-of-concept material lowers the barrier for opportunistic exploitation. The EPSS probability is 0.532% with a percentile of 42.48.

Root Cause

The root cause is improper neutralization of special elements in SQL syntax [CWE-89]. The view_payment.php handler concatenates the ef_id request argument into a SQL statement without using prepared statements, parameter binding, or type enforcement. Any single-quote, comment, or union operator supplied by the client is interpreted by the database.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /view_payment.php with a malicious ef_id value, for example appending boolean, time-based, or UNION-based SQL payloads. Because the parameter is passed through to the query, the attacker can enumerate database schema, extract records such as student and payment data, or manipulate stored rows. See the GitHub Gist PoC Repository and VulDB #272579 Summary for disclosed exploitation details.

Detection Methods for CVE-2024-7165

Indicators of Compromise

HTTP requests to /view_payment.php containing SQL metacharacters in the ef_id parameter, such as single quotes, UNION SELECT, SLEEP(, --, or /* sequences.
Web server access logs showing repeated requests to view_payment.php with unusually long or encoded ef_id values.
Database error messages returned to clients or logged when malformed SQL is submitted through ef_id.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ef_id query parameter for SQL injection signatures on requests to view_payment.php.
Correlate web server logs with database query logs to identify anomalous query structures originating from the payment view handler.
Alert on responses to /view_payment.php that contain database error strings such as SQL syntax, mysql_fetch, or You have an error in your SQL syntax.

Monitoring Recommendations

Enable verbose HTTP logging on the web server hosting School Fees Payment System and forward logs to a centralized analytics platform for retention and search.
Monitor authenticated sessions for repeated failed queries or bursts of requests to view_payment.php from a single source.
Track outbound database connections and query volume for the application account to identify data exfiltration attempts.

How to Mitigate CVE-2024-7165

Immediate Actions Required

Restrict access to the School Fees Payment System to trusted internal networks or authenticated users behind a VPN until a patched build is available.
Deploy WAF rules that block SQL injection payloads targeting the ef_id parameter on /view_payment.php.
Rotate database credentials used by the application and reduce the database account to the minimum privileges required.

Patch Information

No official vendor patch or advisory has been published by oretnom23 at the time of writing. Administrators running SourceCodester School Fees Payment System 1.0 should treat all deployments as vulnerable and apply source-level fixes by replacing string concatenation in view_payment.php with parameterized queries or prepared statements. Refer to VulDB #272579 Incident Report for advisory tracking.

Workarounds

Modify view_payment.php to use PDO or MySQLi prepared statements and bind the ef_id parameter as an integer.
Add server-side input validation that rejects any ef_id value that is not a positive integer before the query executes.
Disable verbose SQL error reporting in production to reduce information leakage that assists attackers in refining injection payloads.

bash

# Example: block SQL injection patterns on ef_id at the reverse proxy (nginx)
location /view_payment.php {
    if ($arg_ef_id ~* "('|\"|--|;|/\*|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://backend;
}