CVE-2024-4798 is a medium severity SQL injection flaw in SourceCodester Online Computer and Laptop Store 1.0, scored 6.3. It sits in the admin brand management page. The record lists no fix, so restrict the admin area, review the code, and plan on replacing the application.
What's affected
The record names SourceCodester Online Computer and Laptop Store 1.0. The flawed file is /admin/maintenance/manage_brand.php, and the id argument reaches a database query unsafely. The weakness is CWE-89.
Unlike many SQL injection reports, the location here is a maintenance screen in the admin area. The vector says low privileges are required, so an account is needed. The record states the attack can be launched remotely and the exploit has been disclosed publicly. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.
NVD gives 6.3 Medium with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The VulDB wording in the record calls it critical. The KEV flag is false.
The same product carries another record in this range, CVE-2024-4820, an unrestricted upload in the system settings.
How to check if you're exposed
- Look for Online Computer and Laptop Store in your web roots and read the version. The record covers 1.0.
- Check for the
/admin/maintenance/folder and themanage_brand.phpfile. - See whether the admin area can be reached from outside the company.
- Check the application's database user for broad rights.
Teams that use sample projects as a starting point for internal tools often forget they are running them. A repository search for the product name across your code hosting is a cheap way to find forks.
What to do now
- Close off the admin path to the internet.
- Limit admin accounts and rotate their passwords.
- If you own the code, change the query in
manage_brand.phpto use a parameterised statement, and check sibling files. - Give the database account the minimum rights.
- Review the database for unexpected records.
- Prefer a maintained product for anything that holds customer data.
Why it matters
A brand edit screen seems harmless, which is exactly why it is often left unchecked. Any page that turns a request value into a query is a candidate for CWE-89, however minor its purpose.
Hobby and tutorial code is written to demonstrate features, not to resist hostile input. Using it in production moves all of the security work onto you. That is a fair reason to scan the code before you deploy it.
Quick check
Does the admin login protect me?
Partly. The vector needs low privileges, so a login is required, but weak or shared admin passwords would undo that.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263918 (not readable without a browser session)
- NVD record data for CVE-2024-4798
Last reviewed: 19 October 2026.
