CVE-2024-0472 is a low severity information exposure vulnerability in code-projects Dormitory Management System 1.0, scored CVSS 3.5. It affects modifyuser.php through the mname argument. No fixed version is named in the record, so check the vendor or project.
What's affected
The record names code-projects Dormitory Management System, version 1.0. The weakness is tracked as CWE-200, CWE-532. The affected code is modifyuser.php. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-12 and the VulDB identifier is VDB-250577.
The record does not name a fixed version, and we could not retrieve the VulDB entry or the linked researcher write up to confirm one. Treat the product as unpatched until the vendor or project tells you otherwise.
How to check if you're exposed
Start with an inventory question: do you run code-projects Dormitory Management System at all? These are small standalone web applications, so they rarely show up in a package manager. Look for them as deployed source trees, not as installed packages. Check web roots, shared hosting accounts, internal tools servers and any container images built from a download of the project.
If you find a copy, confirm the version. The record lists 1.0. Then confirm that modifyuser.php exists in your tree. A command like this, run from the server or a checked out copy, will show whether the file is present:
grep -rn "modifyuser.php" /var/www
If the file is present, assume the copy is affected until you have evidence otherwise. We have not seen a vendor advisory that describes a detection method, so there is no official check to point you to. Review the application's access logs for requests to that path from unexpected sources, and compare against normal use. Unusual or failing requests to a single page are worth a closer look. A log review cannot prove a copy was not abused, but it can help you scope the review.
Dependency scanners will not find a standalone application like this by itself. You can still use the free in-browser dependency scan at gold.safeguard.sh/scan on any project that vendors it as a library, and the Gold directory entry for CVE-2024-0472 tracks the record as it changes.
What to do now
- Find every deployed copy of code-projects Dormitory Management System, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers 1.0.
- Check the vendor or project page for a fixed release. We could not confirm one, so do not assume it exists.
- If the application does not need to be reachable from the internet, move it behind a VPN or an allow list of known addresses now.
- Limit what the affected page returns and who can call it, and make sure database or system error detail never reaches the browser.
- If you cannot patch and the software is not essential, plan to retire or replace it. Unmaintained sample style projects are poor candidates for holding real data.
Try it yourself
This walkthrough shows how a dependency and code inventory helps you find components like this one across many repositories.
Click through it at your own pace, or open it full screen.
Why it matters
Two weakness classes are attached to this record. CWE-200 is information exposure, where data reaches someone who should not have it. CWE-532 is sensitive information written to a log or similar output. The record describes the effect as database information leakage through the mname argument of modifyuser.php. It does not say which data is exposed, so impact depends on your database contents and on how error output is handled in your deployment.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue problematic. The CVSS 3.1 base score attached to the record is 3.5, which is low, with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Both are accurate descriptions of the same record, and they use different scales. For triage we use the CVSS score and the exposure of your own deployment. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-0472 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0472 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The description does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of Dormitory Management System?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0472
- NVD record for CVE-2024-0472, including the VulDB entry VDB-250577, as summarized in the Safeguard record file (we could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed)
Last reviewed: 19 October 2026.
