CVE-2024-4792: Medium SQL Injection in Campcodes Laundry System

CVE-2024-4792 is a medium severity SQL injection flaw in Campcodes Online Laundry Management System 1.0, scored 6.3. It affects the shared file admin_class.php, which handles many actions at once. The record lists no fixed version, so keep the application off the public internet and plan to replace it.

What's affected

The record names Campcodes Online Laundry Management System 1.0. The weak file is /admin_class.php, and the description lists many handler arguments that reach the database: id, delete_category, delete_inv, delete_laundry, delete_supply, delete_user, login, save_inv and save_user. The weakness is CWE-89, SQL injection.

This file is a good example of why one class can reach far. Because login and save and delete actions all run through the same code, a single missing query safeguard can touch authentication and data in one place. The record says the attack can start remotely and the exploit is publicly disclosed. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.

NVD scores it 6.3 Medium, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while VulDB wording calls it critical. Report both. The KEV flag is false.

Campcodes has several other CVEs on this same application, among them CVE-2024-4793 through CVE-2024-4796 for other SQL injection points, CVE-2024-4817 and CVE-2024-4819 for access control. The pattern points to a code base that needs a full review, not one patch.

How to check if you're exposed

This is a PHP sample application, not a registry package.

1. Search web roots and containers for Online Laundry Management System and read its version.
2. Check whether the app is exposed to the internet or to a broad internal network.
3. Search the source for queries that build SQL from request values by joining strings.
4. Review database logs for unusual statements and for errors from the application account.

A static scan of the source can find this class of flaw quickly. The sast-code-scan demo below shows how that looks in practice.

What to do now

1. Remove the application from public access, or place it behind a VPN or an allow list.
2. Run the database account with only the rights the app needs, never as an administrator account.
3. Where you maintain the code, switch queries to parameterised statements, which keep data separate from commands.
4. Put a web application firewall in front as a stopgap, understanding it is not a fix.
5. Back up the database and check for unexpected rows or accounts.
6. Replace the application if you need long term support.

Try it yourself

Click through it at your own pace, or open it full screen.

Why it matters

SQL injection happens when text from a user becomes part of a database command. The database cannot tell the developer's command from the attacker's addition. The remedy has been known for decades: parameterised queries.

The medium score reflects a login requirement in the vector. Yet one of the arguments in the record is the login action itself, so the real exposure depends on how the application is wired. Do not rely on the number alone.

Quick check

Sources

• Public write up referenced by the record (not read)
• VulDB entry 263891 (not readable without a browser session)
• NVD record data for CVE-2024-4792

Last reviewed: 19 October 2026.