CVE-2024-3226 is a high severity (CVSS 7.3) SQL injection in Campcodes Online Patient Record Management System 1.0, in the file /admin/login.php. The record names no fixed version. If you run this software, remove it from public networks, patch the query to use parameterized statements, and watch the vendor page for an update.
What's affected
Campcodes Online Patient Record Management System 1.0. The affected file is /admin/login.php. The record names the argument as password. The record says the attack can be launched remotely and that an exploit has been disclosed publicly. The product handles patient records, so a database leak here would expose health information.
No fixed version, patch or vendor advisory is given in the record. The only references are the VulDB entry and a public write up, which we did not review. Do not assume a newer download is fixed. SourceCodester projects are typically sample applications distributed as source archives, so there may be no maintained release stream at all.
Other issues in the same family: no sibling CVEs in this batch.
The weakness class: CWE-89, SQL injection. The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description calls the issue critical (VulDB wording), while NVD scores it 7.3, High. Both are published. Use NVD for your score and the practical steps above for the fix.
How to check if you're exposed
This is source code you deploy yourself, so the check is about whether the file exists on your server and who can reach it.
find /var/www -name "login.php" 2>/dev/null
Adjust the path to your web root. If the file is present, the install is the affected version unless you have changed the code. Then look at the web server logs for requests to that path from unfamiliar addresses, and check the database for accounts or rows you did not create.
What to do now
- Decide whether the application needs to be running at all. Many deployments are trials or class projects that can be removed.
- If it must stay, restrict access to a private network or behind a VPN, and add authentication at the web server.
- Change the code to use prepared statements with bound parameters for every query in admin/login.php, and validate input types.
- Give the database account the least privilege it needs, and avoid reusing credentials from other systems.
- Rotate passwords stored in or managed by the application, and take a backup before making changes.
Why it matters
SQL injection, CWE-89, happens when user input is joined into a database query as text instead of being passed as a parameter. The database cannot tell the author's query from the visitor's additions. The fix is old and reliable: parameterized queries.
The record scores this high (7.3), not critical, partly because the vector assumes limited impact per vulnerability. In practice a SQL injection on a login or admin page can expose every table the database account can read. The product handles patient records, so a database leak here would expose health information. Where there is no vendor patch, the owner is the maintainer, and that is a good reason to scan code with a static analysis tool and to prefer software with a release process.
Quick check
If NVD says high, is this still urgent?
Treat it as urgent if the application is reachable from the internet. The score reflects a per vulnerability view, and a SQL injection in a login or admin file can expose the whole database. If the app is not exposed and not needed, retire it.
Sources
- References in the NVD record (not individually reviewed): the VulDB entry and a public write up for CVE-2024-3226 (no vendor advisory is listed)
- Safeguard Gold entry for CVE-2024-3226
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
