CVE-2024-3465 is a medium severity SQL injection flaw (CVSS 6.3) in SourceCodester Laundry Management System 1.0, in /application/controller/Transaki.php (function laporan_filter). The record lists no fixed version. Restrict network access to the application, review its logs, and fix the query code or retire the software.
What's affected
The record lists SourceCodester Laundry Management System 1.0 as affected. The weakness is CWE-89 (SQL injection). The issue sits in /application/controller/Transaki.php (function laporan_filter), through the dari and sampai parameter. The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing low privileges and no user interaction.
The description says the attack may be started remotely and that the exploit has been disclosed to the public and may be used. That is a statement about a public write-up, not a report of attacks seen in the wild. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The record gives no fixed version and no vendor patch. I could not confirm one, so check the vendor or project page for any update before you rely on this software.
The same product has other records in this range of identifiers: CVE-2024-3445, CVE-2024-3464, CVE-2024-3466. If you are reviewing one, review the others too, because they point at different files of the same code base.
How to check if you're exposed
Start with an inventory. List every place SourceCodester Laundry Management System runs in your environment, including test and demo copies that people forget. Note the exact version string on each one and compare it with the versions in the record (1.0). For a PHP application that was copied onto a web server, the version is usually in the project folder name, a readme or the admin page footer, so check the files on disk rather than relying on memory.
Then look at the web root for the affected file name, /application/controller/Transaki.php (function laporan_filter). If it exists and the site is reachable from outside your network, treat it as exposed. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Remove the application from the public internet if it does not need to be there. Put it behind a VPN or an IP allow list.
- Block or restrict access to the affected path (
/application/controller/Transaki.php (function laporan_filter)) at the web server or reverse proxy while no fixed release exists. - Review web server and database logs for unusual requests to that path, and for database errors that point to malformed queries.
- Run the database account for this app with the least privilege that works, and keep backups current and tested.
- If you maintain a fork of the code, switch the affected queries to parameterized statements and add a test that sends quote characters through the parameter.
Why it matters
SQL injection happens when an application builds a database query by joining strings and lets user input become part of the query text. The database then cannot tell the developer's instructions from the visitor's data. The record places the problem in the file /application/controller/Transaki.php (function laporan_filter) and its dari and sampai parameter. It does not give more detail than that, and this post does not add any.
The standard fix is a code change. Queries should use parameterized statements, where the SQL text is fixed and values are passed separately. Input checks and an allow list for expected formats help as a second layer, and the database account used by the web app should hold only the permissions the app needs.
A CVSS score of 6.3 reflects the limits in the vector, for example the privileges needed. Score is not the whole story. Hobby and teaching projects like this are often installed with default settings and default admin accounts, which can make a medium score matter more than it looks.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Is there a patch for this SQL injection?
The record does not list a fixed version. Check the vendor or project page for updates, and plan to patch the code yourself or retire the software if none exists.
Does a public exploit mean it is being used in attacks?
Not by itself. The record says an exploit was disclosed, which lowers the effort for an attacker, but the KEV flag is false and no source I read reports attacks in the wild.
Sources
- NVD record data for CVE-2024-3465
- Reference links listed in the record (VulDB entry and researcher write-up), not fetched for this post: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL3.md, https://vuldb.com/?ctiid.259746, https://vuldb.com/?id.259746
Last reviewed: 19 October 2026.
