CVE-2024-5394

itsourcecode Online Student Enrollment System newDept.php sql injection

Published: May 27, 2024Updated: Feb 10, 2025 Sources: CVE List NVDCWE-89

6.3MEDIUM

Description

A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file newDept.php. The manipulation of the argument deptname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266308.

In plain language

AI Worth attention

Online Student Enrollment System 1.0 has a flaw that lets a logged-in attacker tamper with school-system data; small businesses using it should address it soon.

Executive summary

Authenticated remote SQL injection in Online Student Enrollment System 1.0 through the `deptname` parameter in `newDept.php`, allowing database queries to be manipulated.

If affected, business impact

Student record exposureDepartment data changesEnrollment disruptionDatabase data loss

What to do now

Check whether you run Online Student Enrollment System 1.0 and whether newDept.php is present.
Restrict access to the department-management function to only essential, trusted staff while you assess it.
No fixed version has been published; ask the software supplier for a security update for CVE-2024-5394.

May need vendor / contractor work

What is it

This is a weakness in a form used to manage departments. It is like letting someone alter the instructions sent to a filing clerk: instead of handling one requested change, they may be able to read, change, or damage other records in the system.

Who is affected

This matters to you if you run Online Student Enrollment System, especially version 1.0. It is relevant to organizations that use its department-management feature. It is only a risk if an attacker can reach that feature and has a valid login.

How urgent is it

A public proof-of-concept is available, meaning the method for abusing this weakness is publicly documented. Treat this as an amber issue: restrict the affected feature and seek a supplier response promptly, but it is not listed as actively exploited by CISA.

What to do — in detail

Confirm whether the deployed application is Online Student Enrollment System 1.0 and inspect whether newDept.php accepts the deptname input through a department-management workflow. Review which accounts can access that workflow, remove unnecessary accounts, and restrict access to trusted internal users or administrators while a fix is unavailable.

There is no published fixed version or supported upgrade path in the available findings. Contact the supplier or maintainer for a patched release or a code-level correction that uses parameterized database queries; validate any fix in a test copy before deployment. If patching is delayed, disable or tightly restrict the department-management page and review application and database logs for unusual requests or unexpected department-record changes.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor for a vendor patch, suspicious use of newDept.php, unexpected database errors, and unauthorized changes to department or enrollment-related data.

Technical context

CVE-2024-5394 is CWE-89 SQL injection in the deptname argument of newDept.php in Online Student Enrollment System 1.0. CVSS v3.1 is 6.3 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. A public GitHub PoC is known, but CISA KEV does not list the CVE and the findings do not confirm exploitation in the wild. EPSS is 0.6% (48th percentile) with a flat trend. No patch information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:LConfidentiality

Low

I:LIntegrity

Low

A:LAvailability

Low

Open in CVSS calculator →

Weaknesses

CWE-89

Affected Products

itsourcecode

commercial·PHaka tailoring management system, apartment management system, student management system

Online Student Enrollment SystemOn-premWeb App

Enterprise Software / collaboration-groupware

and 1 more affected products View all →

Exploitability

1 exploit source identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Is your org exposed to CVE-2024-5394?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Initial Access

View detailed technique mapping

References

https://github.com/Lanxiy7th/lx_CVE_report-/issues/7

github.com

https://vuldb.com/?ctiid.266308

vuldb.com

https://vuldb.com/?id.266308

vuldb.com

and 1 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2024-5394 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows