CVE-2024-3315 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Computer Laboratory Management System 1.0, reachable through the id parameter of classes/user.php. The record lists no fixed version, so treat the application as vulnerable until you patch the query or take it off the network. A public exploit is reported.
What's affected
The record names one product and one version: Computer Laboratory Management System 1.0 from SourceCodester, a lab scheduling and user management app. The affected file is classes/user.php, and the weakness is in how the id input is used. The record says the attack can be launched remotely and that the exploit has been disclosed to the public.
The weakness class is CWE-89, improper neutralization of special elements in an SQL command. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms that is network reachable, low complexity, no user interaction, and the attacker needs a low privilege account. Confidentiality, integrity and availability impacts are each rated low.
I could not find a vendor advisory or a patched release. The references are third party write ups and the VulDB entry, VDB-259386. Nothing in the record says a fixed version exists, so do not assume one does. Check the project download page before relying on that.
The application is written in PHP and backed by MySQL, which is typical of small PHP projects distributed as source archives. Those archives are usually deployed as is, with no package manager, no version pin and no update channel, so nobody is told when a flaw is published.
How to check if you're exposed
This is not a package you install with a package manager, so a dependency scan will not find it by name. Look for it the way you would look for any self hosted PHP app.
- Search your servers and repositories for the application name or for the file path
classes/user.php. A command such asgrep -rl "user.php" /var/wwwshows where a copy is deployed. - Check the version. This record covers version 1.0, so any deployed copy of that release is in scope.
- Check whether the application is reachable from the internet or from a wider internal network than it needs.
- Review web server access logs for requests to that path that contain quote characters, SQL keywords or unusually long values in the id input. Treat any hits as a reason to start an incident review.
- Confirm the database account the application uses. If it is a high privilege account, the damage from any injection is larger.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the libraries your projects pull in, which helps you find the other flaws around an app like this one.
What to do now
- Find every deployed copy of Computer Laboratory Management System and decide whether it still needs to exist.
- If it must stay, put it behind a VPN or an IP allow list and remove it from public access.
- Replace string built SQL for the id parameter in
classes/user.phpwith prepared statements and bound parameters. Validate the input type as well. - Move the application to a database account with only the permissions it needs. It should not own the schema or read other databases.
- Add a web application firewall rule as a stopgap, and keep database and web logs for at least the period since the April 2024 disclosure.
- Rotate any credentials stored in that database if you find signs of probing.
- Check the vendor page again for a patched release and note the result in your risk register.
Why it matters
The cause is simple. The code takes a value from the request and places it into an SQL statement without separating data from commands. When that happens, input can change what the query does. Prepared statements fix the whole class because the database never treats the value as SQL.
Admin scripts like this are often assumed to be hidden behind a login, but the record rates the flaw as reachable remotely, and file paths in small PHP apps are easy to guess. The record does not say this flaw is being exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list. The public disclosure of a working exploit is still enough reason to act, because it lowers the effort for anyone who finds a copy of the app online.
Quick check
Is there a patched version of Computer Lab Mgmt System?
The record does not list one, and I did not find a vendor advisory. Check the project download page. Until a fixed release exists, restrict access and fix the query in your own copy.
Does CVE-2024-3315 appear in the CISA KEV list?
No. The record marks it as not known exploited. A public exploit exists, so treat it as likely to be tried, not as confirmed in use.
Sources
Last reviewed: 19 October 2026.
