CVE-2024-2554 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Employee Task Management System 1.0. The update-employee.php file builds a database query from the admin_id argument without safe handling. The record lists no fixed version, so restrict access or change the code.
What's affected
SourceCodester Employee Task Management System 1.0, as listed in the record's CPE data. The affected file is /update-employee.php. The admin_id argument is passed into a SQL query, which makes it injectable. Any copy of that release should be assumed affected.
The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-89 (SQL injection).
The record names no fixed version and I found no vendor patch in its references. This is a small PHP project of the kind distributed as sample code, so a patch from the original author is unlikely to arrive on any schedule you can plan around.
How to check if you're exposed
This is source code you deploy, so start with the version. Check the version file, the release tag or the download you used, and confirm whether it is SourceCodester Employee Task Management System 1.0.
Then look for the vulnerable file in your web root:
find /var/www -name 'update-employee.php' 2>/dev/null
If the file exists on a server that anyone other than you can reach, assume it is exposed. Web server logs for the file name can show who has requested it.
What to do now
- Find every instance of the application, including test and demo copies, and note who can reach it.
- Take it off any network that is not trusted until it is fixed or replaced.
- If you must keep it, change the code yourself using the fix described under Why it matters, and test it.
- Put the application behind a login at the web server or a VPN so unauthenticated visitors cannot reach it.
- Review the application and database logs for unexpected requests to update-employee.php.
- Plan a move to a maintained product if the data is business relevant.
Why it matters
The weakness is SQL injection. Input from the request is placed into a database query without being separated from the query structure, so a crafted value can change what the query does. Depending on the table and the database account, that means reading rows the user was never meant to see, changing records, or in some setups going further.
The reliable fix is the same in every language: parameterised queries, a database account with only the rights the page needs, and server-side validation of types. Filtering bad characters by hand tends to fail. If you run the application and no patched release exists, treat its code as something you must change yourself or take off the network.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2024-2554 need a login?
The record says the attack can be launched remotely and gives CVSS privileges required as low, so some account may be needed. Do not rely on that to decide urgency.
Sources
Last reviewed: 19 October 2026.
