CVE-2024-6453 is a medium severity (CVSS 6.3) SQL injection in itsourcecode Farm Management System 1.0. The quarantine page passes several request fields into a database query. No patch is listed, so rewrite the query or take the app off any network you do not control.
What's affected
The record names Farm Management System 1.0 from itsourcecode. The file is /quarantine.php, called with an id, and the arguments called out are pigno, breed and reason. The record includes a note that the original submission mentioned only pigno, and that the other parameters were added later. So a fix that patches one field is not enough.
The weakness is CWE-89. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. VulDB tracks the issue as VDB-270241. A public exploit is reported in the record, and the KEV flag is false.
The record points to a GitHub issue as the original write-up. I could not load it, so there is no vendor advisory or patched release to cite.
How to check if you're exposed
- Look for the application on your servers:
find /var/www -name "quarantine.php"
- Open the file and check each of the three named fields. Any that are joined into the SQL string are vulnerable.
- Check access logs for requests to
quarantine.phpfrom unfamiliar addresses and for fields that contain quotes or SQL keywords. - Check whether the page can be reached without logging in.
What to do now
- If this is a coursework or demo install, shut it down.
- For a live farm record system, put it behind a VPN or an IP allow list straight away.
- Rewrite the query using prepared statements with bound parameters for all of
pigno,breed,reasonandid. - Search the rest of the project for the same pattern. Projects of this kind tend to repeat a coding style across pages.
- Back up the database and check the records for tampering, in particular animal and quarantine entries.
- Restrict the database account to the tables the app needs.
Why it matters
Small management systems hold records that people rely on, in this case animal health and quarantine status. Altered records can cause real work and cost even when no data is stolen.
The wider lesson sits in the record's note: the first report named one parameter and others were affected too. When you fix an injection bug, fix the query pattern and not the single field in the report.
Quick check
Which parameters are affected?
The record names pigno, breed and reason, and notes that the first report mentioned only pigno. Treat all three as unsafe.
Should I wait for a vendor patch?
The record lists none. Restrict access now and fix the queries yourself if you must keep running it.
Sources
- NVD record for CVE-2024-6453
- VulDB entry 270241 and the public issue cited by the record (neither was retrievable when this post was prepared)
Last reviewed: 19 October 2026.
