CVE-2024-1197 is a High severity SQL injection, scored 7.3, in SourceCodester Testimonial Page Manager 1.0. The flaw is in delete-testimonial.php, through the testimony argument of a GET request. The record names no fixed version, so remove the sample app from any reachable server or fix the query yourself.
What's affected
The record lists Testimonial Page Manager 1.0 by SourceCodester. The file delete-testimonial.php in the HTTP GET request handler builds a query from the testimony argument in an unsafe way.
No fixed version is named, and I could not read the VulDB entry. SourceCodester publishes sample and teaching projects, so a vendor patch stream may not exist. Treat the code as something you must fix or remove, not wait on.
How to check if you're exposed
Search web roots for delete-testimonial.php. A quick way on a Linux server is the following.
find /var/www -name delete-testimonial.php 2>/dev/null
If it exists, check whether the site is reachable from outside. Review web logs for requests to the file with unusual testimony values, and review the database for unexpected changes.
What to do now
- Search servers for the Testimonial Page Manager project.
- Take it offline if it is a demo or no longer needed.
- If you must keep it, change the delete query to use prepared statements and require a signed in administrator.
- Make the delete action a POST with a CSRF token, not a GET.
- Back up the database and review it for tampering.
Why it matters
The class is SQL injection, CWE-89. Input from the URL becomes part of a database query, so an attacker can change the query's meaning. The fix is the standard one: parameterised queries.
A delete action reachable by GET and without a login makes things worse, since anyone, or a crawler, can trigger it. Sample code copied into production is a common source of these bugs, and an inventory of what runs on your web servers is the best defence. The record's KEV flag is false.
Quick check
Is there a vendor patch?
The record names none. Remove the app or fix the query with prepared statements.
What is the root cause?
Input from the testimony argument is placed into a SQL query without safe handling.
Sources
Last reviewed: 19 October 2026.
