CVE-2024-7853: Yoga Class Registration System SQLi Flaw

CVE-2024-7853 Overview

CVE-2024-7853 is a SQL injection vulnerability in the SourceCodester Yoga Class Registration System version 1.0, developed by oretnom23. The flaw resides in the /admin/?page=categories/view_category endpoint, where the id parameter is passed directly into a database query without proper sanitization. Attackers with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter to read, modify, or delete data in the backend database of the Yoga Class Registration System.

Affected Products

Oretnom23 Yoga Class Registration System 1.0
SourceCodester Yoga Class Registration System (all builds up to 1.0)
Deployments using the vulnerable categories/view_category admin module

Discovery Timeline

2024-08-16 - CVE-2024-7853 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7853

Vulnerability Analysis

The vulnerability affects the administrative category view function within the Yoga Class Registration System. When an administrator visits /admin/?page=categories/view_category, the application accepts the id HTTP parameter and concatenates it into a SQL query executed against the backend database. Because the input is neither validated nor parameterized, an attacker can append additional SQL clauses to alter query logic.

The issue is classified under CWE-89. Exploitation requires network access to the admin interface and low-level authentication on the target application. Successful injection can enumerate database schemas, extract user credentials stored in the application, or manipulate registration records.

See the public technical writeup and the VulDB entry #274758 for reproduction steps.

Root Cause

The root cause is unsanitized concatenation of user-controlled input into a SQL statement inside the view_category handler. The application does not use prepared statements or bound parameters, and it lacks input type enforcement on the id field, which should be treated as an integer identifier.

Attack Vector

An attacker sends a crafted HTTP GET request to the admin endpoint with a malicious id value. Because the endpoint is reachable over the network and requires only low privileges, an attacker who compromises or registers a low-tier admin account can weaponize the flaw. Public disclosure of the exploit lowers the barrier for automated scanning.

No verified proof-of-concept code is republished here. Refer to the linked references for payload details.

Detection Methods for CVE-2024-7853

Indicators of Compromise

HTTP requests to /admin/?page=categories/view_category containing SQL meta-characters such as single quotes, UNION, SELECT, SLEEP, or comment sequences in the id parameter
Unexpected database errors or extended response times originating from the category view endpoint
New or modified rows in administrative tables that do not correspond to legitimate operator activity

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting the id query parameter on admin routes
Enable verbose query logging on the MySQL/MariaDB backend and alert on syntactically anomalous statements originating from the application user
Correlate access logs with authentication logs to detect low-privilege admin sessions issuing repeated requests to categories/view_category

Monitoring Recommendations

Baseline normal traffic to /admin/?page=categories/view_category and alert on volume or payload deviations
Monitor egress from the application host for data exfiltration following suspicious admin requests
Review database audit logs for INFORMATION_SCHEMA queries that the application does not issue during normal use

How to Mitigate CVE-2024-7853

Immediate Actions Required

Restrict network access to the /admin/ path to trusted management networks or VPN users
Rotate credentials for all administrative accounts on affected deployments
Deploy WAF signatures for SQL injection targeting the id parameter until a code fix is applied

Patch Information

No vendor patch is listed in the referenced advisories. Operators should track the VulDB entry and the SourceCodester project page for updates. Where no upstream fix is available, apply the source-level remediation described below.

Workarounds

Replace the vulnerable query in view_category with a prepared statement that binds id as an integer parameter
Cast the id parameter to an integer at the controller level before it reaches any database code
Disable or remove the categories/view_category module if it is not required for business operations
Place the application behind an authenticating reverse proxy to reduce exposure of the admin panel

bash

# Example PHP remediation: use PDO prepared statements instead of string concatenation
# Replace vulnerable code such as:
#   $sql = "SELECT * FROM categories WHERE id = ".$_GET['id'];
# With a parameterized query:
$stmt = $pdo->prepare('SELECT * FROM categories WHERE id = :id');
$stmt->bindValue(':id', (int) $_GET['id'], PDO::PARAM_INT);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);