CVE-2024-10736
📋 TL;DR
This critical SQL injection vulnerability in Codezips Free Exam Hall Seating Management System 1.0 allows attackers to manipulate database queries via the email parameter in /student.php. Remote attackers can potentially access, modify, or delete sensitive data including student information and system credentials. All deployments of version 1.0 are affected.
💻 Affected Systems
- Codezips Free Exam Hall Seating Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, or destruction of all exam seating data and student records
Likely Case
Unauthorized access to sensitive student data, exam schedules, and potential privilege escalation within the system
If Mitigated
Limited impact with proper input validation and database permissions preventing data modification
🎯 Exploit Status
Public exploit details available on GitHub; SQL injection via email parameter requires minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for email parameter in student.php
Modify student.php to add: $email = mysqli_real_escape_string($connection, $_POST['email']);
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database-level protections: use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test /student.php endpoint with SQL injection payloads in email parameter: ' OR '1'='1Check Version:
Check application files or documentation for version 1.0 referencesVerify Fix Applied:
Test with same payloads; should return error or no database manipulation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL characters in email field
Network Indicators:
- HTTP POST requests to /student.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/student.php" AND (email="*OR*" OR email="*UNION*" OR email="*SELECT*")