CVE-2024-10760
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in the /dodelete.php file of University Event Management System 1.0. Attackers can potentially read, modify, or delete database content. All users running the affected software version are at risk.
💻 Affected Systems
- University Event Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive university event data, student information, or administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If no patch available, implement workarounds immediately. 3. Consider migrating to alternative software if vendor is unresponsive.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'id' parameter in /dodelete.php
Edit /dodelete.php to add: if (!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /dodelete.php?id=1' OR '1'='1 to see if SQL error appearsCheck Version:
Check application documentation or admin panel for version informationVerify Fix Applied:
Retest with same payload after implementing fixes - should return error page or sanitized response📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed delete attempts with malformed IDs
- Requests to /dodelete.php with SQL keywords in parameters
Network Indicators:
- Unusual database connection patterns from web server
- Large volume of requests to vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/dodelete.php" AND (param="id" AND value MATCHES "[';]|OR|UNION|SELECT")