CVE-2024-7845 Overview
CVE-2024-7845 is a SQL injection vulnerability in SourceCodester Online Graduate Tracer System 1.0. The flaw resides in the /tracking/admin/fetch_it.php script, where the request parameter is passed directly into a database query without sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Remote attackers with low privileges can execute arbitrary SQL queries against the backend database, potentially exposing or modifying graduate tracer records.
Affected Products
- Tamparongj03 Online Graduate Tracer System 1.0
- Deployments referencing cpe:2.3:a:tamparongj03:online_graduate_tracer_system:1.0
- Any downstream fork of the SourceCodester Online Graduate Tracer System that retains the vulnerable fetch_it.php endpoint
Discovery Timeline
- 2024-08-16 - CVE-2024-7845 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7845
Vulnerability Analysis
The vulnerability affects the administrative fetch handler at /tracking/admin/fetch_it.php. The script accepts a request argument from the client and incorporates it into a SQL query without parameterization or escaping. An attacker who can reach the admin path with valid low-privilege credentials can craft the request value to break out of the intended query context.
Successful exploitation allows the attacker to read arbitrary tables, enumerate schema data, and potentially modify graduate records maintained by the system. Because the endpoint is reachable over the network, exploitation does not require local access. The exploit details have been published on public disclosure platforms, including Wsstiger's CVE documentation on GitHub and VulDB entry #274748.
Root Cause
The root cause is missing input validation and unsafe query construction in fetch_it.php. User-supplied data from the request parameter is concatenated into a SQL statement rather than bound as a parameter. PHP applications that rely on string concatenation with mysqli_query or similar APIs are prone to this class of flaw when developer-side sanitization is absent.
Attack Vector
The attack is delivered over the network against the admin interface. An attacker sends a crafted HTTP request to /tracking/admin/fetch_it.php with a malicious payload in the request parameter. Typical payloads include UNION SELECT statements to exfiltrate data or boolean-based conditions to enumerate database contents. Because authentication with low privileges is required, exploitation is most likely from insider accounts, compromised admin credentials, or environments with weak password policies.
No verified proof-of-concept code is reproduced here. Refer to the public disclosure on GitHub for full technical details of the payload structure.
Detection Methods for CVE-2024-7845
Indicators of Compromise
- HTTP requests to /tracking/admin/fetch_it.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the request parameter.
- Web server access logs showing repeated malformed queries against fetch_it.php from a single source.
- Unexpected database errors or long-running queries originating from the tracer application user.
- Anomalous read volume from graduate-record tables outside normal administrative activity.
Detection Strategies
- Deploy a web application firewall rule that inspects the request parameter on fetch_it.php for SQL injection signatures.
- Enable database query logging and alert on queries that reference information_schema, mysql.user, or contain stacked statements.
- Correlate authentication events for administrative accounts with subsequent requests to fetch_it.php to identify credential misuse.
Monitoring Recommendations
- Centralize web server, PHP error, and database logs to a SIEM for cross-source correlation.
- Baseline typical fetch_it.php request patterns and alert on deviations in parameter length or character composition.
- Monitor egress traffic from the application server for signs of data exfiltration following suspicious query activity.
How to Mitigate CVE-2024-7845
Immediate Actions Required
- Restrict network access to the /tracking/admin/ path to trusted management networks or VPN users only.
- Rotate credentials for all administrative accounts and enforce strong password policies.
- Review web and database logs for prior exploitation attempts targeting fetch_it.php.
- Consider taking the application offline if it is internet-facing and no compensating controls exist.
Patch Information
At the time of publication, no vendor patch has been listed in the referenced advisories. Organizations running SourceCodester Online Graduate Tracer System 1.0 should track the VulDB entry #274748 for updates and apply fixes as soon as they become available. In the interim, apply the workarounds below and audit any custom code that touches the request parameter.
Workarounds
- Modify fetch_it.php to use prepared statements with bound parameters via mysqli_prepare or PDO instead of string concatenation.
- Add server-side allowlist validation on the request parameter to reject unexpected characters before it reaches the query.
- Place the application behind a web application firewall configured with SQL injection signatures tuned for PHP applications.
- Apply least-privilege permissions to the database account used by the application so it cannot read or modify unrelated tables.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
