CVE-2024-3014 is a Medium severity (CVSS 6.3) SQL injection in SourceCodester Simple Subscription Website 1.0, in the Actions.php file through the title argument. The record names no patched release, so treat the code as unsafe: take it off the internet, or fix the query to use parameters before it handles real data.
What's affected
The record lists Simple Subscription Website version 1.0 from SourceCodester. The affected element is Actions.php, and the argument is title. The weakness is CWE-89, improper neutralization of special elements in an SQL command.
The description calls the issue "critical", which is VulDB's wording. The CVSS 3.1 base score is 6.3, which is Medium, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack runs over the network and needs low privileges. Impact on confidentiality, integrity and availability is rated low. I report both labels: the text says critical, the score says medium.
The record says the exploit has been disclosed to the public, under VulDB entry 258300. No fixed version is named and I did not find a vendor advisory. Projects of this kind are typically sample or tutorial code published for download, so there may be no vendor to issue a patch.
How to check if you're exposed
Find out whether the application is deployed anywhere. Search your servers and repositories for the file named in the record:
grep -rl "Actions.php" /var/www 2>/dev/null
If the project came from a downloaded source archive, check the application's title and version in the page footer or readme. Any deployment of version 1.0 is in scope.
Then check what the database account behind the application can do. If it has broad rights, a successful injection reaches far more than one table.
What to do now
- Take any public instance of Simple Subscription Website offline, or put it behind a login at the web server.
- Rewrite the query in
Actions.phpso thetitlevalue is bound as a parameter, not joined into the SQL string. - Give the application's database user the minimum rights it needs.
- Add a web application firewall rule or input validation as a stopgap, understanding that it is not a fix.
- Retire sample applications from production hosts. If you need the features, use a maintained product.
Why it matters
SQL injection has been understood for decades, and it persists because string building is the easiest way to write a query. A parameterized statement keeps data and commands apart so a value can never become part of the SQL.
The record does not list this CVE as exploited in the wild, and it carries no CISA Known Exploited Vulnerabilities flag. Still, a public write-up for a small, widely downloaded project means scanners can find it. Student and demo projects that end up on real servers are a quiet source of incidents.
The Gold page for CVE-2024-3014 tracks the entry, and the free in-browser dependency scan at gold.safeguard.sh/scan helps you see which third party packages your own projects pull in.
Quick check
Is there a patched version?
The record does not name one. Fix the query yourself with parameterized statements or stop using the application.
Why is the score lower than the word critical suggests?
The description uses VulDB wording. The CVSS 3.1 score is 6.3 (Medium) because the vector needs low privileges and rates impact as low.
Sources
Last reviewed: 19 October 2026.
