A vulnerability

CVE-2024-1928 is an SQL injection flaw in SourceCodester Web-Based Student Clearance System 1.0. The vulnerable path is /admin/edit-admin.php on the *Edit User Profile* workflow, where the Fullname parameter is reported as injectable. The affected software appears to be the single downloadable 1.0 release published on SourceCodester; I could not find a newer fixed upstream release or vendor patch advisory.

The original CNA score of 4.7 / MEDIUM is closer to reality than the later NVD enrichment to 7.2 / HIGH. The decisive friction is PR:H: an attacker already needs high-privilege application access to reach the vulnerable form, which makes this a post-auth, narrow-reach bug in a low-footprint PHP app rather than an internet-scale initial-access event.

Why this verdict

• Down from the vendor/NVD noise: the reachable population is narrow because the attacker must reach an authenticated admin-only page, not a public endpoint.
• Post-initial-access penalty: PR:H means the exploit assumes stolen admin credentials, an insider, or a chained earlier compromise; every one of those is compounding downward pressure on severity.
• Low enterprise prevalence: this is SourceCodester hobbyware/academic PHP, not a broadly deployed business platform, so the fleet-level blast radius is small even if the code is vulnerable.

Why not higher?

I am not scoring this higher because there is no strong evidence of active exploitation, no KEV listing, and no sign of a turnkey SQLi PoC that defenders should expect to be mass-used tomorrow. Most importantly, the attacker already needs privileged app access, which strips away the main thing that makes SQL injection urgent in the real world: cheap unauthenticated reach.

Why not lower?

I am not dropping this to IGNORE because authenticated SQL injection is still a trust-boundary failure and can let a malicious admin session bypass application logic to read or tamper with backend data. If you actually run this app, especially internet-exposed, it still deserves cleanup and compensating controls even if it is not an emergency.

1. Put /admin behind identity controls — Require VPN, SSO, and MFA for the admin path so the main exploit prerequisite stays hard. For a LOW verdict there is no noisgate mitigation SLA; treat this as backlog hygiene, but do it during the next normal access-control hardening cycle.
2. Restrict source IPs to admin pages — Allow only campus IT, helpdesk jump hosts, or management subnets to reach /admin/*. That sharply reduces who can even attempt the vulnerable workflow; for LOW, there is no formal mitigation deadline, so roll this into routine perimeter cleanup.
3. Watch for edits to edit-admin.php workflows — Add web log monitoring for unusual POSTs to /admin/edit-admin.php, especially quote-heavy or SQL-metacharacter-laden Fullname values. For LOW, implement as part of normal detection engineering rather than a break-fix sprint.
4. Plan replacement or code remediation — Because no authoritative patched release is visible, the durable fix is local code repair: parameterized queries, least-privilege DB credentials, and possibly retiring this app entirely. For LOW, schedule this as backlog maintenance instead of emergency patching.

Run this on the target Linux/PHP web host or a mounted container image, not from an auditor workstation. Invoke it as sudo bash verify-cve-2024-1928.sh /var/www or point it at your web root; root is helpful for reading all app files but not strictly required if permissions are open enough.

#!/usr/bin/env bash
# verify-cve-2024-1928.sh
# Detect likely presence of SourceCodester Web-Based Student Clearance System 1.0
# affected by CVE-2024-1928.
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage error
#
# Notes:
# - No authoritative fixed upstream version was found during research.
# - If the app fingerprint is found, this script reports VULNERABLE.
# - If nothing matches, it reports UNKNOWN rather than claiming safety.

set -euo pipefail

ROOT="${1:-/var/www}"

if [[ ! -d "$ROOT" ]]; then
  echo "UNKNOWN - path not found: $ROOT"
  exit 2
fi

found=0

while IFS= read -r -d '' f; do
  dir="$(dirname "$f")"
  parent="$(dirname "$dir")"

  # Heuristics for this specific app family
  login_php="$dir/login.php"
  app_root="$parent"

  indicator_score=0

  if grep -Rqs "student_clearance_system_Aurthur_Javis" "$app_root" 2>/dev/null; then
    indicator_score=$((indicator_score+1))
  fi

  if grep -Rqs "student_clearance" "$app_root" 2>/dev/null; then
    indicator_score=$((indicator_score+1))
  fi

  if [[ -f "$login_php" ]] && grep -qs "admin" "$login_php"; then
    indicator_score=$((indicator_score+1))
  fi

  # Direct CVE path match
  if [[ "$f" == */admin/edit-admin.php ]]; then
    indicator_score=$((indicator_score+1))
  fi

  if (( indicator_score >= 2 )); then
    echo "VULNERABLE - probable SourceCodester Web-Based Student Clearance System instance found at: $app_root"
    found=1
  fi
done < <(find "$ROOT" -type f -name 'edit-admin.php' -path '*/admin/*' -print0 2>/dev/null)

if (( found == 1 )); then
  exit 1
fi

echo "UNKNOWN - no authoritative fixed version is known, and no matching app fingerprint was found under: $ROOT"
exit 2

Sources

1. NVD CVE-2024-1928
2. CIRCL Vulnerability-Lookup entry for CVE-2024-1928
3. SourceCodester project page for Web-Based Student Clearance System
4. GitHub reference linked by VulDB/NVD
5. CISA Known Exploited Vulnerabilities Catalog
6. CISA Vulnerability Summary for the week of February 26, 2024
7. OpenCVE snapshot for CVE-2024-1928
8. OSV record for CVE-2024-1928