CVE-2024-0461 is a medium severity SQL injection vulnerability in code-projects Online Faculty Clearance 1.0, scored CVSS 6.3. It affects deactivate.php through the haydi argument of the HTTP POST request handler. The record names no fixed version, so check the vendor or project and restrict access.
What's affected
The record names code-projects Online Faculty Clearance, 1.0. The weakness is SQL injection: input reaches a database query without being kept separate from the query itself. The weakness is tracked as CWE-89. The affected code is deactivate.php, reached through the haydi argument of the HTTP POST request handler. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-12 and the VulDB identifier is 250566.
The record links a researcher's write up, but we could not read it in usable form, and the VulDB entry is behind a bot check, so we cannot add details beyond the record.
The record does not name a fixed version. Treat the product as unpatched until the vendor or project says otherwise. It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
How to check if you're exposed
Search the source tree for the page. If you have shell access to the server, a command like this shows whether the file is present and where:
find /var/www -name "deactivate.php"
Then read how the page builds its query. Any query assembled by joining strings with request values is the pattern the record describes. Queries that use prepared statements with bound parameters are not.
Next look at your access logs for that path. Repeated requests with unusual characters in the haydi argument of the HTTP POST request handler, or with database error messages in the response, are worth reviewing. Logs cannot prove nothing happened, but they help you size the review. Check the database account the application uses, because the damage depends on what that account can read and change.
A dependency scanner will not find a standalone application like this on its own, because it is deployed code, not a package. You can still use Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan on any project that bundles it as a library, and the Gold entry for CVE-2024-0461 tracks the record as it changes.
What to do now
- Find every deployed copy of Online Faculty Clearance, including staging and forgotten hosting accounts.
- Record the version. The record covers 1.0.
- Look for a fixed release on the vendor or project page. We could not confirm one.
- If you have the source, change the query in deactivate.php to use prepared statements with bound parameters, and validate the input type.
- Restrict access to the application, for example with a VPN or an allow list, until the code is fixed.
- Reduce the database account's rights to what the application needs, so a successful injection reaches less.
- If the software is not essential, retire it. Practice style projects are poor homes for real data.
Why it matters
SQL injection has been understood for over two decades, and the fix is also well known: keep data and query structure apart with prepared statements. When a page builds its query by joining strings, a value that should be data can change the meaning of the query.
The impact depends on the database account and the data behind it. Here the application is a small web application that holds its data in a database, and the record's own CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That reads as medium severity at 6.3. VulDB's description calls the issue critical, which is its own classification. The CVSS figure and that label are different scales, and we report both.
This record is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0461 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list and the sources we could read do not report exploitation. The description says a public exploit exists, so do not wait for confirmation.
Is there a fixed version of Online Faculty Clearance?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0461
- NVD record for CVE-2024-0461, including VulDB entry 250566, as summarized in the Safeguard record file. We could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed.
Last reviewed: 19 October 2026.
