CVE-2024-7166: School Fees Payment System SQLi Flaw

CVE-2024-7166 Overview

CVE-2024-7166 is a SQL injection vulnerability in SourceCodester School Fees Payment System 1.0, developed by oretnom23. The flaw resides in the /receipt.php script, where the ef_id parameter is passed directly into a database query without proper sanitization. Attackers can manipulate this argument to execute arbitrary SQL statements against the backend database. The vulnerability is remotely exploitable and requires only low-privileged authentication. A public proof of concept has been disclosed under VulDB identifier VDB-272580, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL through the ef_id parameter in /receipt.php, enabling unauthorized read and write access to the school fees database.

Affected Products

SourceCodester School Fees Payment System 1.0
oretnom23 school_fees_payment_system (CPE: cpe:2.3:a:oretnom23:school_fees_payment_system:1.0)
Deployments referencing the vulnerable /receipt.php endpoint

Discovery Timeline

2024-07-28 - CVE-2024-7166 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7166

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] affecting the receipt generation workflow of the School Fees Payment System. The /receipt.php script accepts an ef_id parameter from the HTTP request and concatenates it directly into a SQL statement. Because the application does not use prepared statements or input validation, an attacker can break out of the intended query context and append arbitrary SQL clauses. Successful exploitation allows reading arbitrary tables, modifying financial records, or extracting stored credentials. The attack is executed remotely over the network and requires only low-level user privileges to reach the vulnerable endpoint.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The developer concatenates the user-supplied ef_id value into a query string rather than binding it as a parameter. No allowlist, type check, or escaping routine is applied before the value reaches the database driver, leaving the query grammar under attacker control.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /receipt.php with a malicious ef_id value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads. The database interprets the injected fragment as part of the query, returning attacker-controlled data or executing modifications. Because the endpoint is reachable over the network, exposure of the application to the internet significantly increases risk. A public proof of concept is available in the GitHub PoC Gist and additional analysis is documented at VulDB #272580.

No verified exploit code is reproduced here. Refer to the linked references for technical payload details.

Detection Methods for CVE-2024-7166

Indicators of Compromise

HTTP requests to /receipt.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ef_id parameter.
Unusually long or URL-encoded ef_id values that deviate from expected numeric identifiers.
Database error messages returned to clients following requests to the receipt endpoint.
Anomalous read volume or query latency against the school fees database tied to a single session.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the ef_id parameter.
Enable database query logging and alert on UNION, INFORMATION_SCHEMA, or timing-function usage originating from the web tier.
Correlate web server access logs with authentication events to identify low-privileged accounts issuing suspicious receipt requests.

Monitoring Recommendations

Baseline normal request patterns for /receipt.php and alert on deviations in parameter length, encoding, or character class.
Monitor for outbound data transfers from the database host that follow spikes in receipt endpoint traffic.
Track failed and successful logins to the application to detect credential stuffing that precedes exploitation.

How to Mitigate CVE-2024-7166

Immediate Actions Required

Restrict network exposure of the School Fees Payment System to trusted networks or a VPN until a fix is applied.
Audit /receipt.php and any code path that consumes ef_id, replacing string concatenation with parameterized queries.
Rotate database credentials and review audit logs for evidence of prior exploitation given public PoC availability.

Patch Information

No vendor patch is listed in the NVD entry or the referenced advisories. Administrators should track updates from the SourceCodester project maintainer and apply source-code fixes directly by refactoring the vulnerable query. Details are available at VulDB #272580 (CTI).

Workarounds

Place a WAF in front of the application with rules blocking SQL injection payloads on the ef_id parameter.
Enforce strict server-side input validation that limits ef_id to numeric characters of the expected length.
Apply the principle of least privilege to the database account used by the application, revoking DDL and cross-database rights.
Disable verbose database error messages in production to reduce information leakage useful for exploitation.

bash

# Example nginx rule to block obvious SQLi payloads against /receipt.php
location /receipt.php {
    if ($arg_ef_id ~* "('|\"|--|;|union|select|sleep\(|information_schema)") {
        return 403;
    }
}