CVE-2024-2999 is a Medium severity (CVSS 6.3) SQL injection in Campcodes Online Art Gallery Management System 1.0, in the /admin/adminHome.php file through the uname argument. The record names no patched release, so treat the code as unsafe: take it off the internet, or fix the query to use parameters before it handles real data.
What's affected
The record lists Online Art Gallery Management System version 1.0 from Campcodes. The affected element is /admin/adminHome.php, and the argument is uname. The weakness is CWE-89, improper neutralization of special elements in an SQL command.
The description calls the issue "critical", which is VulDB's wording. The CVSS 3.1 base score is 6.3, which is Medium, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack runs over the network and needs low privileges. Impact on confidentiality, integrity and availability is rated low. I report both labels: the text says critical, the score says medium.
The record says the exploit has been disclosed to the public, under VulDB entry 258201. No fixed version is named and I did not find a vendor advisory. Projects of this kind are typically sample or tutorial code published for download, so there may be no vendor to issue a patch.
How to check if you're exposed
Find out whether the application is deployed anywhere. Search your servers and repositories for the file named in the record:
grep -rl "adminHome.php" /var/www 2>/dev/null
If the project came from a downloaded source archive, check the application's title and version in the page footer or readme. Any deployment of version 1.0 is in scope.
Then check what the database account behind the application can do. If it has broad rights, a successful injection reaches far more than one table.
What to do now
- Take any public instance of Online Art Gallery Management System offline, or put it behind a login at the web server.
- Rewrite the query in
/admin/adminHome.phpso theunamevalue is bound as a parameter, not joined into the SQL string. - Give the application's database user the minimum rights it needs.
- Add a web application firewall rule or input validation as a stopgap, understanding that it is not a fix.
- Retire sample applications from production hosts. If you need the features, use a maintained product.
Why it matters
SQL injection has been understood for decades, and it persists because string building is the easiest way to write a query. A parameterized statement keeps data and commands apart so a value can never become part of the SQL.
The record does not list this CVE as exploited in the wild, and it carries no CISA Known Exploited Vulnerabilities flag. Still, a public write-up for a small, widely downloaded project means scanners can find it. Student and demo projects that end up on real servers are a quiet source of incidents.
The Gold page for CVE-2024-2999 tracks the entry, and the free in-browser dependency scan at gold.safeguard.sh/scan helps you see which third party packages your own projects pull in.
Quick check
Is there a patched version?
The record does not name one. Fix the query yourself with parameterized statements or stop using the application.
Why is the score lower than the word critical suggests?
The description uses VulDB wording. The CVSS 3.1 score is 6.3 (Medium) because the vector needs low privileges and rates impact as low.
Sources
Last reviewed: 19 October 2026.
