CVE-2024-10507
📋 TL;DR
This critical SQL injection vulnerability in Codezips Free Exam Hall Seating Management System 1.0 allows attackers to manipulate database queries via the email parameter in /login.php. Attackers can potentially access, modify, or delete sensitive data including student records and system credentials. All deployments of version 1.0 with the vulnerable component exposed are affected.
💻 Affected Systems
- Codezips Free Exam Hall Seating Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, credential harvesting, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive student and exam data, potential authentication bypass, and database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via email parameter requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries and input validation.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the email parameter in /login.php
Input Validation Filter
allAdd server-side validation to reject suspicious email parameter values containing SQL keywords
Add to login.php: if (preg_match('/[\'\"\;\-\-\/\*\|]/', $_POST['email'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls, allowing only trusted IP addresses.
- Implement database monitoring and alerting for unusual SQL query patterns from the application.
🔍 How to Verify
Check if Vulnerable:
Test /login.php with SQL injection payloads in email parameter: ' OR '1'='1Check Version:
Check system documentation or admin panel for version information. No standard command available.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL patterns in email field
- Database query logs showing unexpected UNION or SELECT statements
Network Indicators:
- HTTP POST requests to /login.php containing SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/login.php" AND (email="*OR*" OR email="*UNION*" OR email="*SELECT*")