CVE-2024-4919

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Campcodes Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /adminpanel/admin/query/addCourseExe.php. The manipulation of the argument course_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264454 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Online Examination System	1.0

References

https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_addCourseExe.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.264454Permissions Required, VDB Entry
https://vuldb.com/?id.264454Permissions Required, VDB Entry
https://vuldb.com/?submit.333416Third Party Advisory, VDB Entry
https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_addCourseExe.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.264454Permissions Required, VDB Entry
https://vuldb.com/?id.264454Permissions Required, VDB Entry
https://vuldb.com/?submit.333416Third Party Advisory, VDB Entry

Timeline

Published: May 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-491937.5Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming CVE-2024-491947.3Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL p CVE-2024-491959.8Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair CVE-2024-491967.5An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service.CVE-2024-491976.5An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W93 CVE-2024-49209.8A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. This issue affects some unknown CVE-2024-492006.4An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption CVE-2024-492014.3Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information coul CVE-2024-492027.6Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.CVE-2024-49203Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community me CVE-2024-492083.1Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files.CVE-2024-492094.3Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application fi