CVE-2024-12890
📋 TL;DR
This critical SQL injection vulnerability in Online Exam Mastering System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'eid' parameter in the /update.php endpoint. Attackers can potentially access, modify, or delete database contents including exam data, user credentials, and system configurations. All deployments of version 1.0 are affected.
💻 Affected Systems
- Online Exam Mastering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, credential harvesting, system takeover, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to exam data, user information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit details available on hackmd.io. SQL injection via URL parameter makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the /update.php endpoint
Input Validation Filter
allImplement server-side input validation for the 'eid' parameter to allow only expected data types
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules to limit exposure
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Check if application responds to crafted SQL injection payloads at /update.php?q=quiz&step=2&eid=[SQLI_PAYLOAD]Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /update.php with suspicious parameters
- Database query errors containing SQL syntax
Network Indicators:
- HTTP requests to /update.php containing SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri_path="/update.php" AND (query_string="*SELECT*" OR query_string="*UNION*" OR query_string="*OR*1=1*")