CVE-2024-12964
📋 TL;DR
This critical SQL injection vulnerability in Daily College Class Work Report Book 1.0 allows remote attackers to execute arbitrary SQL commands via the 'user' parameter in /login.php. Attackers can potentially access, modify, or delete database content, including sensitive student and academic records. All users running version 1.0 of this software are affected.
💻 Affected Systems
- Daily College Class Work Report Book
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student records, grade manipulation, and potential credential theft from the database.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://1000projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting /login.php
Input Validation Filter
allAdd server-side input validation for the 'user' parameter to reject SQL special characters
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /login.php endpoint with SQL injection payloads in the 'user' parameter (e.g., ' OR '1'='1)Check Version:
Check application documentation or about page for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL patterns
- Database query errors from login.php
Network Indicators:
- HTTP POST requests to /login.php containing SQL keywords
- Unusual database port traffic from web server
SIEM Query:
source="web_logs" AND uri="/login.php" AND (user="*OR*" OR user="*UNION*" OR user="*SELECT*")