CVE-2024-2264 is a high severity SQL injection flaw in keerti1924 PHP-MYSQL-User-Login-System 1.0, scored CVSS 7.3. The email argument handled by /login.php can change a database query. The record names no fixed version, so find every copy, restrict access and check the vendor or project for a patch.
What's affected
The record names keerti1924 PHP-MYSQL-User-Login-System version 1.0. The weakness is CWE-89, SQL injection. The affected code is /login.php, and the manipulated argument is email. The record says the attack can be launched remotely and that an exploit has been disclosed to the public. It was published on 2024-03-07, and the VulDB identifier is VDB-256034.
The CVSS vector lists no privileges required, so on paper an anonymous visitor can reach the flaw. The record also notes the vendor was contacted early and did not respond.
The record does not name a fixed version. We did not retrieve the VulDB entry or the linked write up, so we cannot confirm that a patch exists. Treat the product as unpatched until the vendor or project says otherwise.
How to check if you're exposed
Start with an inventory question. Do you run PHP-MYSQL-User-Login-System at all? Small standalone PHP applications like this rarely appear in a package manager, so look for deployed source trees instead: web roots, shared hosting accounts, internal tool servers and container images built from a downloaded copy.
If you find one, confirm the version (the record lists 1.0) and confirm the file exists. From the server or a checked out copy:
grep -rn "login.php" /var/www
If the file is present, treat the copy as affected until you have evidence otherwise. We saw no vendor advisory describing a detection method, so there is no official check to point to. Review web server access logs for requests to login.php, and compare them with normal use. Unusual or repeated failing requests to one page deserve a closer look. A log review cannot prove a copy was never abused, but it helps you scope the work.
A dependency scanner will not find a standalone application by itself. You can still run the free in-browser dependency scan on any project that vendors this code, and the Gold page for CVE-2024-2264 tracks the record as it changes.
What to do now
- Find every deployed copy of PHP-MYSQL-User-Login-System, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers 1.0.
- Check the vendor or project page for a fixed release. We could not confirm one, so do not assume it exists.
- If the application does not need to be public, move it behind a VPN or an allow list of known addresses now.
- If you can maintain the source, replace string built queries in the affected page with parameterized queries, and do the same for every similar page. One fixed file in an application like this rarely means the rest are safe.
- If the software is not essential and nobody maintains it, plan to retire or replace it. Unmaintained sample style projects are poor homes for real data.
Why it matters
SQL injection happens when an application builds a database query by pasting user input into the query text. The database cannot tell the application's own query logic from the data a visitor supplied. Depending on the database account the application uses, the result can be reading rows that should stay private, changing records, or more. The record says only that the manipulation of email leads to SQL injection. It does not describe the database account, the data behind it or the impact on a real deployment, so we will not guess.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue critical. The CVSS 3.1 base score attached to the record is 7.3, which is high, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Both are accurate descriptions of the same record on different scales. For triage we rely on the CVSS score and on how exposed your own deployment is. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-2264 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though the sources we could read record no exploitation.
Quick check
Is CVE-2024-2264 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The record does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of PHP-MYSQL-User-Login-System?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-2264
- NVD record for CVE-2024-2264 (description, CVSS vector, CWE and publication date), as held in the Safeguard record set. The linked VulDB entry VDB-256034 and the researcher write up were referenced by the record but could not be retrieved.
Last reviewed: 19 October 2026.
