CVE-2024-7810: Online Graduate Tracer System SQLi Flaw

CVE-2024-7810 Overview

CVE-2024-7810 is a SQL injection vulnerability in SourceCodester Online Graduate Tracer System 1.0, developed by tamparongj03. The flaw resides in /tracking/admin/view_itprofile.php, where the id parameter is passed directly to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires only low-privileged authentication. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL through the id parameter of view_itprofile.php, enabling unauthorized read and modification of the tracer system database.

Affected Products

SourceCodester Online Graduate Tracer System 1.0
Vendor: tamparongj03
CPE: cpe:2.3:a:tamparongj03:online_graduate_tracer_system:1.0

Discovery Timeline

2024-08-15 - CVE-2024-7810 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7810

Vulnerability Analysis

The Online Graduate Tracer System is a PHP and MySQL web application used to track graduate profiles and employment data. The administrative view view_itprofile.php accepts an id query parameter to display an individual IT graduate profile. This parameter is concatenated into a SQL statement without prepared statements or input validation. As a result, an attacker can append additional SQL syntax that the database interprets as part of the intended query.

Successful exploitation allows an attacker to enumerate database schema, extract stored records such as user credentials or graduate personal information, and potentially modify or delete data. Depending on database privileges, secondary attack primitives such as file read via LOAD_FILE or authentication bypass through UNION-based queries may also be possible.

Root Cause

The root cause is direct concatenation of unsanitized user input into a SQL query, a classic instance of [CWE-89]. The application does not use parameterized queries, does not enforce type casting on the id argument, and does not apply an allow-list validation before the value reaches the database driver.

Attack Vector

An attacker sends a crafted HTTP GET request to /tracking/admin/view_itprofile.php?id=<payload> while authenticated to the admin area. The attack requires network access to the application and low-privileged credentials. No user interaction is required. Public proof-of-concept material is available at the GitHub PoC Repository and the VulDB entry #274706, which document injection payloads against the vulnerable parameter.

No verified code example is available for reproduction in this article. Refer to the linked references for payload details.

Detection Methods for CVE-2024-7810

Indicators of Compromise

Unusual HTTP requests to /tracking/admin/view_itprofile.php containing SQL keywords such as UNION, SELECT, SLEEP, AND 1=1, or single quotes in the id parameter.
Web server access logs showing long, URL-encoded values in the id query string.
Database error messages returned to clients or logged by the application when malformed input reaches MySQL.
Spikes in query latency consistent with time-based blind SQL injection payloads.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects the id parameter of view_itprofile.php for SQL metacharacters and known injection patterns.
Enable MySQL general or slow query logging and alert on queries against the tracer database that contain conditional expressions attached to numeric identifiers.
Correlate authenticated admin sessions with unexpected outbound requests or bulk row reads from tables such as users or graduate_profile.

Monitoring Recommendations

Ingest web server, application, and MySQL logs into a centralized analytics platform for correlation across the request lifecycle.
Alert on repeated 500-series responses from view_itprofile.php, which often accompany injection probing.
Track admin account activity for anomalous access times or source IP addresses that may indicate credential abuse combined with injection.

How to Mitigate CVE-2024-7810

Immediate Actions Required

Restrict access to /tracking/admin/ to trusted management IP ranges via network ACLs or reverse proxy rules.
Rotate all administrative credentials for the Online Graduate Tracer System and enforce strong password policies.
Deploy WAF signatures that block SQL injection payloads targeting the id parameter until the application code is remediated.
Review web and database logs for prior exploitation attempts referencing view_itprofile.php.

Patch Information

No official vendor patch has been published for CVE-2024-7810 at the time of writing. No vendor advisory URLs are listed in the NVD record. Organizations running this software should apply source-level fixes: replace concatenated SQL with prepared statements using PHP PDO or mysqli parameter binding, and validate the id parameter as an integer before use.

Workarounds

Modify view_itprofile.php locally to cast $_GET['id'] to an integer using intval() before passing it to the query.
Convert the affected query to a parameterized statement, for example using PDO::prepare with a bound :id placeholder.
If the application is not business-critical, take it offline until proper remediation is applied.
Isolate the MySQL account used by the application with least-privilege grants, removing FILE, DROP, and cross-database permissions.

bash

# Example nginx configuration to restrict admin path by source IP
location /tracking/admin/ {
    allow 10.0.0.0/24;
    deny all;
}