CVE-2024-12899
📋 TL;DR
This critical SQL injection vulnerability in the 1000 Projects Attendance Tracking Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the course_code parameter in the /admin/course_action.php file. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 of this software are affected.
💻 Affected Systems
- 1000 Projects Attendance Tracking Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to attendance records, course data, and potentially user credentials stored in the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting SQL execution.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://1000projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject malicious SQL characters in the course_code parameter
Modify /admin/course_action.php to sanitize input using prepared statements or parameterized queries
Web Application Firewall Rule
allBlock SQL injection patterns targeting the course_action.php endpoint
Add WAF rule to detect and block SQL injection attempts on /admin/course_action.php
🧯 If You Can't Patch
- Isolate the system on a separate network segment with strict firewall rules limiting access
- Implement database-level controls: restrict database user permissions, enable logging of all SQL queries
🔍 How to Verify
Check if Vulnerable:
Test the /admin/course_action.php endpoint with SQL injection payloads in the course_code parameterCheck Version:
Check the software version in the admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that prepared statements are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts from single IP
- Unexpected database queries containing SQL keywords
Network Indicators:
- HTTP requests to /admin/course_action.php with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri="/admin/course_action.php" AND (param="course_code" AND value MATCH "('|\"|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP)")