CVE-2024-4799 is a medium severity SQL injection flaw in Kashipara College Management System 1.0, scored 6.3. It affects the page that shows one faculty member's record, through the id argument. The record lists no fixed version, so isolate the system and plan a replacement.
What's affected
The record names Kashipara College Management System 1.0. The file is view_each_faculty.php, and the id argument reaches a query unsafely. The weakness is CWE-89. The record says the attack can start remotely and a public disclosure exists. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.
NVD scores it 6.3 Medium with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, where VulDB's wording says critical. Report both. The KEV flag is false.
This is one of a run of SQL injection records filed against the same product on the same day, covering other pages such as student and faculty submission forms, user edit and delete pages. This post covers only view_each_faculty.php. If you run the product, treat all of its pages as suspect and review the whole code base, not one file.
How to check if you're exposed
- Find any deployment of Kashipara College Management System and read its version.
- Confirm whether the web interface is on the open internet or a campus network.
- Check the data it holds. Student and faculty records bring privacy duties for the institution.
- Search the source for queries built by joining request values into strings, and list every file that does so.
What to do now
- Put the application behind a VPN or an IP allow list immediately.
- Back up the database and review it for unexpected changes.
- Give the application's database account only the rights it needs.
- Convert queries to parameterised statements in every page, not only the one named.
- Tell your data protection contact if the system holds personal data and was exposed.
- Replace the application with a maintained system.
Why it matters
Education systems hold personal data on minors and staff, so even a medium rated flaw can have a heavy impact. A lookup page keyed on an id is the textbook place for CWE-89: the id arrives from the address, and the code trusts it.
The fix is mechanical for a developer, and that is the sad part. The same safeguard, parameterised queries, would close every one of the related records at once.
Quick check
Do the other Kashipara CVEs share the same fix?
The records describe separate files, so each needs checking, but the cure for all of them is the same technique, parameterised queries.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263919 (not readable without a browser session)
- NVD record data for CVE-2024-4799
Last reviewed: 19 October 2026.
