CVE-2024-7931: Online Graduate Tracer System SQLi Vulnerability

CVE-2024-7931 Overview

CVE-2024-7931 is a SQL injection vulnerability in SourceCodester Online Graduate Tracer System 1.0. The flaw resides in the /tracking/admin/view_csprofile.php script, where the id parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Remote attackers with low privileges can extract, modify, or destroy backend database contents through the vulnerable id parameter.

Affected Products

Tamparongj03 Online Graduate Tracer System 1.0
The view_csprofile.php administrative component
Deployments referencing CPE cpe:2.3:a:tamparongj03:online_graduate_tracer_system:1.0

Discovery Timeline

2024-08-19 - CVE-2024-7931 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7931

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the administrative profile view endpoint. When a request is made to /tracking/admin/view_csprofile.php, the application takes the id GET parameter and concatenates it directly into a SQL query. Because the value is neither parameterized nor filtered, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires only network access to the application and low-level authentication to reach the admin path. Public disclosure of the technique lowers the barrier to exploitation, since payloads are available in the referenced GitHub CVE documentation. Impact spans confidentiality, integrity, and availability of the underlying database.

Root Cause

The root cause is improper neutralization of user-supplied input before it is embedded in a SQL statement. The id parameter is used to build the query string dynamically without prepared statements or input validation. Any character permitted in HTTP query strings, including single quotes, UNION keywords, and comment markers, flows straight into the SQL parser.

Attack Vector

The attack vector is a crafted HTTP request against the view_csprofile.php endpoint. Typical payloads use UNION SELECT clauses to exfiltrate table contents such as user credentials, or boolean and time-based blind techniques to enumerate schemas. Automated tooling such as sqlmap can weaponize the parameter with minimal manual effort. See the VulDB entry #275117 for additional technical context.

Detection Methods for CVE-2024-7931

Indicators of Compromise

HTTP requests to /tracking/admin/view_csprofile.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or information_schema.
Unusually long or URL-encoded values in the id query parameter.
Database error messages or stack traces returned in web server logs adjacent to requests against the affected endpoint.
Anomalous outbound query volume or unexpected access to sensitive tables in the backend database.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection payloads in the id parameter of the view_csprofile.php path.
Enable database query logging and alert on queries containing UNION SELECT, information schema access, or high-cardinality result sets originating from the tracer application.
Correlate authenticated admin sessions with sudden spikes in requests to view_csprofile.php to identify enumeration attempts.

Monitoring Recommendations

Continuously monitor web access logs for repeated requests to the vulnerable endpoint with varying id values.
Alert on HTTP 500 responses from view_csprofile.php, which frequently accompany SQL syntax errors during probing.
Track privileged database account activity to spot unauthorized schema reads or credential table access.

How to Mitigate CVE-2024-7931

Immediate Actions Required

Restrict network access to /tracking/admin/ paths using IP allow-listing or authenticated reverse-proxy controls until a fix is available.
Rotate credentials for any database account used by the application, assuming potential exposure through prior exploitation.
Review web server and database logs for signs of injection attempts against view_csprofile.php.
Take the application offline if it is internet-facing and cannot be adequately isolated.

Patch Information

No vendor patch has been published for SourceCodester Online Graduate Tracer System 1.0 at the time of this writing. Operators must apply their own code-level remediation. Replace dynamic SQL construction with parameterized queries or prepared statements, and validate that the id parameter is a numeric identifier before use. Consult the VulDB CTI record for updates on remediation status.

Workarounds

Implement input validation that rejects any non-integer value for the id parameter before the query executes.
Deploy a WAF rule set such as the OWASP Core Rule Set with SQL injection protections tuned for the affected URL.
Enforce least-privilege database accounts so the application user cannot read or modify tables outside the tracer schema.
Consider migrating to a maintained alternative if the software will not receive vendor updates.

bash

# Example nginx snippet to block non-numeric id values on the vulnerable endpoint
location = /tracking/admin/view_csprofile.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://backend;
}