CVE-2024-10424
📋 TL;DR
This critical SQL injection vulnerability in Project Worlds Student Project Allocation System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'no' parameter in the remove_project.php file. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 of this software are affected.
💻 Affected Systems
- Project Worlds Student Project Allocation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to student/project data, grade manipulation, or system disruption through data deletion.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Public exploit code available on GitHub. Simple SQL injection via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Implement workarounds or replace with secure alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and SQL injection protection to remove_project.php
Edit remove_project.php to add parameter validation using prepared statements or proper escaping
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection attempts
Add WAF rule: block requests containing SQL keywords in 'no' parameter
🧯 If You Can't Patch
- Block access to /student/project_selection/remove_project.php at network or application level
- Implement strict database user permissions with least privilege principle
🔍 How to Verify
Check if Vulnerable:
Test by sending SQL injection payload to the 'no' parameter in remove_project.php endpointCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application user
Network Indicators:
- HTTP requests to remove_project.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/student/project_selection/remove_project.php" AND (param="no" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR")