CVE-2024-7167: School Fees Payment System SQLi Flaw

CVE-2024-7167 Overview

CVE-2024-7167 is a SQL injection vulnerability in SourceCodester School Fees Payment System 1.0, developed by oretnom23. The flaw resides in the /manage_course.php script, where the id parameter is passed unsanitized into a backend SQL query. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability is tracked as VulDB entry VDB-272581 and is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers with low privileges can extract, modify, or destroy database contents through the id parameter of /manage_course.php, exposing student and payment records.

Affected Products

SourceCodester School Fees Payment System 1.0
Vendor: oretnom23
CPE: cpe:2.3:a:oretnom23:school_fees_payment_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-07-28 - CVE-2024-7167 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7167

Vulnerability Analysis

The vulnerability affects the manage_course.php endpoint in the School Fees Payment System web application. The id request parameter flows directly into a SQL query without parameterization or input sanitization. Attackers can append SQL syntax to the parameter and alter query semantics. Because the application handles student and financial data, successful exploitation can expose personally identifiable information, payment records, and administrative credentials stored in the backing database.

A proof-of-concept has been published on GitHub Gist, meaning attack payloads are already circulating in the public domain. See the GitHub Gist PoC Repository and the VulDB Entry #272581 for additional technical context. The current EPSS score is 0.532% with a percentile of 42.158.

Root Cause

The root cause is improper neutralization of user-supplied input in a SQL statement, categorized as [CWE-89]. The id GET parameter is concatenated into the SQL query string rather than bound as a prepared statement parameter. No allowlist, type coercion, or escaping is applied before the value reaches the database driver.

Attack Vector

The attack vector is network-based and requires only low-privilege authentication to the web application. An attacker crafts a request to /manage_course.php?id=<payload> where the payload contains SQL syntax such as UNION SELECT statements or boolean-based blind injection primitives. No user interaction is required beyond issuing the HTTP request. Because the exploit has been disclosed publicly, automated scanners can trivially reproduce it.

No verified exploit code is reproduced here. Refer to the GitHub Gist PoC Repository for the disclosed proof-of-concept.

Detection Methods for CVE-2024-7167

Indicators of Compromise

HTTP requests to /manage_course.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or -- inside the id parameter.
Unusual database error responses returned from the School Fees Payment System web tier.
Spikes in outbound response size from manage_course.php indicating data exfiltration through UNION-based queries.
New or modified rows in users, courses, or payments tables outside normal administrative activity.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the id query parameter for SQL keywords and encoded variants.
Enable database query logging and alert on statements originating from the web application that contain tautologies such as OR 1=1.
Correlate authentication logs with manage_course.php access to identify low-privilege accounts issuing anomalous request volumes.

Monitoring Recommendations

Forward web server access logs and PHP error logs to a centralized SIEM for pattern matching on injection payloads.
Baseline normal parameter values for id (typically small integers) and alert on deviations containing non-numeric input.
Monitor for repeated 500-series responses from manage_course.php, which often indicate injection probing.

How to Mitigate CVE-2024-7167

Immediate Actions Required

Restrict network access to the School Fees Payment System, placing it behind a VPN or IP allowlist until a patched build is available.
Deploy WAF rules blocking SQL metacharacters in the id parameter of /manage_course.php.
Rotate database credentials and audit user tables for unauthorized modifications.
Review web and database logs for indicators of prior exploitation.

Patch Information

At the time of publication, no vendor advisory or official patch has been released by oretnom23 for School Fees Payment System 1.0. Organizations running this application should treat it as end-of-support for security purposes and evaluate replacement. Track the VulDB Entry #272581 for any future vendor updates.

Workarounds

Modify manage_course.php to cast the id parameter to an integer with intval($_GET['id']) before use in SQL statements.
Refactor affected queries to use parameterized statements via PDO or MySQLi prepared statements.
Remove or protect /manage_course.php behind additional authentication if the application is not actively maintained.
Isolate the database account used by the web application to least-privilege read/write on only the required tables.

bash

# Example WAF rule (ModSecurity) blocking SQLi in the id parameter
SecRule ARGS:id "@rx (?i)(union(.*?)select|sleep\(|--|';|/\*)" \
    "id:1002741,phase:2,deny,status:403,\
    msg:'Potential SQLi against manage_course.php (CVE-2024-7167)',\
    tag:'CVE-2024-7167'"