CVE-2024-3438 is a high severity SQL injection flaw (CVSS 7.3) in SourceCodester Prison Management System 1.0, in /Admin/login.php. The record lists no fixed version. Restrict network access to the application, review its logs, and fix the query code or retire the software.
What's affected
The record lists SourceCodester Prison Management System 1.0 as affected. The weakness is CWE-89 (SQL injection). The issue sits in /Admin/login.php. The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing no privileges and no user interaction.
The description says the attack may be started remotely and that the exploit has been disclosed to the public and may be used. That is a statement about a public write-up, not a report of attacks seen in the wild. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The record gives no fixed version and no vendor patch. I could not confirm one, so check the vendor or project page for any update before you rely on this software.
The same product has other records in this range of identifiers: CVE-2024-3436, CVE-2024-3437, CVE-2024-3439, CVE-2024-3440, CVE-2024-3441, CVE-2024-3442. If you are reviewing one, review the others too, because they point at different files of the same code base.
How to check if you're exposed
Start with an inventory. List every place SourceCodester Prison Management System runs in your environment, including test and demo copies that people forget. Note the exact version string on each one and compare it with the versions in the record (1.0). For a PHP application that was copied onto a web server, the version is usually in the project folder name, a readme or the admin page footer, so check the files on disk rather than relying on memory.
Then look at the web root for the affected file name, /Admin/login.php. If it exists and the site is reachable from outside your network, treat it as exposed. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Remove the application from the public internet if it does not need to be there. Put it behind a VPN or an IP allow list.
- Block or restrict access to the affected path (
/Admin/login.php) at the web server or reverse proxy while no fixed release exists. - Review web server and database logs for unusual requests to that path, and for database errors that point to malformed queries.
- Run the database account for this app with the least privilege that works, and keep backups current and tested.
- If you maintain a fork of the code, switch the affected queries to parameterized statements and add a test that sends quote characters through the parameter.
Why it matters
SQL injection happens when an application builds a database query by joining strings and lets user input become part of the query text. The database then cannot tell the developer's instructions from the visitor's data. The record places the problem in the file /Admin/login.php. It does not give more detail than that, and this post does not add any.
The standard fix is a code change. Queries should use parameterized statements, where the SQL text is fixed and values are passed separately. Input checks and an allow list for expected formats help as a second layer, and the database account used by the web app should hold only the permissions the app needs.
A CVSS score of 7.3 means the record sees little needed to reach the flaw. Treat it as a reason to take the system off the open internet first and read code second.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for this SQL injection?
The record does not list a fixed version. Check the vendor or project page for updates, and plan to patch the code yourself or retire the software if none exists.
Does a public exploit mean it is being used in attacks?
Not by itself. The record says an exploit was disclosed, which lowers the effort for an attacker, but the KEV flag is false and no source I read reports attacks in the wild.
Sources
- NVD record data for CVE-2024-3438
- Reference links listed in the record (VulDB entry and researcher write-up), not fetched for this post: https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL1.md, https://vuldb.com/?ctiid.259691, https://vuldb.com/?id.259691
Last reviewed: 19 October 2026.
