CVE-2024-4817 is a medium severity flaw in Campcodes Online Laundry Management System 1.0, scored 6.3. The id argument of manage_user.php is not properly controlled, which exposes user records by identifier. The record lists no fixed version, so limit access and plan a replacement.
What's affected
The record names Campcodes Online Laundry Management System 1.0, file manage_user.php, in a component called the HTTP Request Parameter Handler. The weaknesses are CWE-99, improper control of resource identifiers, and CWE-639, authorization bypass through a user controlled key. This is commonly called an insecure direct object reference. The record says the attack can start remotely and a public disclosure exists. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.
NVD gives 6.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and VulDB's wording calls it critical. The KEV flag is false.
The same application has related records: CVE-2024-4819 for another authorization gap, and several SQL injection records such as CVE-2024-4795 on the same manage_user.php file. Different weakness, same page.
How to check if you're exposed
- Find the application and read its version. The record covers 1.0.
- Check whether the admin screens can be reached by users who should only see their own data.
- Review how the page decides which record to show. If it trusts the id in the request, it has this weakness.
- Search access logs for runs of requests to the page with sequential ids.
A dynamic scan of a running copy finds this class well, because it can compare what different accounts can see.
What to do now
- Put the application behind a VPN or an allow list.
- If you own the code, check the signed in user's rights on the server for every record fetch, not only at login.
- Replace guessable sequential ids with values the user cannot enumerate, as a secondary measure.
- Review user accounts for changes you did not make.
- Rotate passwords after review.
- Plan to move to a maintained product.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
A direct object reference bug is a missing question: is this user allowed to see this record? The page answers with whatever the id asks for. Nothing exotic is needed, which is why CWE-639 stays on top lists of web flaws.
It also shows why access control cannot be left to the interface. Hiding a link is not a check. The server must decide for every request.
Quick check
How is this different from SQL injection?
It abuses missing permission checks on a legitimate query, while SQL injection changes the query itself.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263938 (not readable without a browser session)
- NVD record data for CVE-2024-4817
Last reviewed: 19 October 2026.
