CVE-2024-12488
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks via the 'id' parameter in the /pages/subject_update.php file in code-projects Online Class and Exam Scheduling System 1.0. Attackers can potentially read, modify, or delete database content. Organizations using this specific version of the scheduling system are affected.
💻 Affected Systems
- code-projects Online Class and Exam Scheduling System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover through SQL injection escalation.
Likely Case
Unauthorized data access, manipulation of scheduling data, or extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub documentation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure 'id' parameter contains only numeric values
Modify subject_update.php to include: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the subject_update.php endpoint
WAF rule: Block requests to /pages/subject_update.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Block external access to /pages/subject_update.php via firewall rules
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test the /pages/subject_update.php endpoint with SQL injection payloads in the 'id' parameter (e.g., id=1' OR '1'='1)Check Version:
Check system documentation or configuration files for version 1.0 indicationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages instead of database results📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to subject_update.php with varying id parameters
Network Indicators:
- HTTP requests to /pages/subject_update.php containing SQL keywords (UNION, SELECT, etc.) in parameters
SIEM Query:
source="web_logs" AND uri="/pages/subject_update.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR*1=1*")🔗 References
- https://code-projects.org/
- https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_subject_update_php%20.docx
- https://vuldb.com/?ctiid.287870
- https://vuldb.com/?id.287870
- https://vuldb.com/?submit.459097
- https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_subject_update_php%20.docx
