CVE-2024-5119 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Event Registration System. The last_id/event_id input handled by /classes/Master.php?f=load_registration reaches a database query unsafely. The record names no fixed version, so remove the application from exposure or patch the query yourself.
What's affected
The record lists SourceCodester Event Registration System (version 1.0) and says the flaw is in /classes/Master.php?f=load_registration, through the last_id/event_id argument. The vulnerable code is the shared Master.php class, reached with the f=load_registration function selector. A single class that serves many functions means one unsafe pattern can repeat across them.
The record gives no fixed version and no vendor patch, and the public write up was posted by an independent researcher. The identifier VDB-265199 is VulDB's tracking number. Sources of this kind describe projects distributed as learning or demo code, so a patch from the author may never arrive.
How to check if you're exposed
First find out whether you run this software at all. Search your web roots and repositories:
find /var/www -name 'Master.php' 2>/dev/null
grep -rn "last_id" /var/www --include=*.php | head
If the file is present, open it and look for the parameter being placed straight into a query string. Review web server logs for requests to this path that carry quote characters or SQL keywords in the parameter. A web application scan of a staging copy can confirm the behavior without touching production.
What to do now
- Review every function selected through the f parameter in Master.php.
- Convert event_id and last_id to integers and bind them in the query.
- Limit the database account to the tables Master.php needs.
- Check access logs for requests to Master.php with unusual parameter values.
- Plan a replacement if the product has no maintained release.
- Scan the whole app, not just this endpoint.
Why it matters
SQL injection (CWE-89) happens when user input is concatenated into a query string, so the database cannot tell data from instructions. The result depends on database privileges and on what the query does: reading rows the page never meant to show, changing them, or in some setups reaching further. A dispatcher style file is a common design in small PHP apps: one entry point, many actions. It makes review simpler in one way, since all the queries are in one class, and riskier in another, since a reviewer must check every action.
The published description says the exploit has been disclosed to the public and may be used, so assume that anyone who looks can find the technique. The record does not set the KEV flag, so there is no CISA report of active exploitation in it.
Quick check
Why look at other functions in Master.php?
Because the same coding habit likely appears in neighbouring functions of the same class.
How does this differ from CVE-2024-5117?
Different file and parameters. 5117 is the portal login, this is the registration loader.
Sources
Last reviewed: 19 October 2026.
