CVE-2024-2168 is a medium severity SQL injection flaw in SourceCodester Online Tours & Travels Management System 1.0, scored CVSS 4.7. The status argument handled by /admin/operations/expense_category.php can change a database query. The record names no fixed version, so find every copy, restrict access and check the vendor or project for a patch.
What's affected
The record names SourceCodester Online Tours & Travels Management System version 1.0. The weakness is CWE-89, SQL injection. The affected code is /admin/operations/expense_category.php, and the manipulated argument is status. The record says the attack can be launched remotely and that an exploit has been disclosed to the public. It was published on 2024-03-04, and the VulDB identifier is VDB-255678.
The CVSS vector lists high privileges required, which usually means an administrator level account is needed first.
The record does not name a fixed version. We did not retrieve the VulDB entry or the linked write up, so we cannot confirm that a patch exists. Treat the product as unpatched until the vendor or project says otherwise.
How to check if you're exposed
Start with an inventory question. Do you run Online Tours & Travels Management System at all? Small standalone PHP applications like this rarely appear in a package manager, so look for deployed source trees instead: web roots, shared hosting accounts, internal tool servers and container images built from a downloaded copy.
If you find one, confirm the version (the record lists 1.0) and confirm the file exists. From the server or a checked out copy:
grep -rn "expense_category.php" /var/www
If the file is present, treat the copy as affected until you have evidence otherwise. We saw no vendor advisory describing a detection method, so there is no official check to point to. Review web server access logs for requests to expense_category.php, and compare them with normal use. Unusual or repeated failing requests to one page deserve a closer look. A log review cannot prove a copy was never abused, but it helps you scope the work.
A dependency scanner will not find a standalone application by itself. You can still run the free in-browser dependency scan on any project that vendors this code, and the Gold page for CVE-2024-2168 tracks the record as it changes.
What to do now
- Find every deployed copy of Online Tours & Travels Management System, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers 1.0.
- Check the vendor or project page for a fixed release. We could not confirm one, so do not assume it exists.
- If the application does not need to be public, move it behind a VPN or an allow list of known addresses now.
- If you can maintain the source, replace string built queries in the affected page with parameterized queries, and do the same for every similar page. One fixed file in an application like this rarely means the rest are safe.
- If the software is not essential and nobody maintains it, plan to retire or replace it. Unmaintained sample style projects are poor homes for real data.
Why it matters
SQL injection happens when an application builds a database query by pasting user input into the query text. The database cannot tell the application's own query logic from the data a visitor supplied. Depending on the database account the application uses, the result can be reading rows that should stay private, changing records, or more. The record says only that the manipulation of status leads to SQL injection. It does not describe the database account, the data behind it or the impact on a real deployment, so we will not guess.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue critical. The CVSS 3.1 base score attached to the record is 4.7, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. Both are accurate descriptions of the same record on different scales. For triage we rely on the CVSS score and on how exposed your own deployment is. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-2168 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though the sources we could read record no exploitation.
Quick check
Is CVE-2024-2168 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The record does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of Online Tours & Travels Management System?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-2168
- NVD record for CVE-2024-2168 (description, CVSS vector, CWE and publication date), as held in the Safeguard record set. The linked VulDB entry VDB-255678 and the researcher write up were referenced by the record but could not be retrieved.
Last reviewed: 19 October 2026.
