CVE-2024-33405 – This SQL injection vulnerability in campcodes C... (How to Fix)

Q: What is the severity of CVE-2024-33405?

CVE-2024-33405 has a CVSS score of 8.6 (HIGH). This SQL injection vulnerability in campcodes Complete Web-Based School Management System 1.0 allows attackers to execute arbitrary SQL commands through the friend_index parameter in add_friends.php. This could lead to data theft, modification, or deletion. All users running version 1.0 of this software are affected.

📋 TL;DR

This SQL injection vulnerability in campcodes Complete Web-Based School Management System 1.0 allows attackers to execute arbitrary SQL commands through the friend_index parameter in add_friends.php. This could lead to data theft, modification, or deletion. All users running version 1.0 of this software are affected.

💻 Affected Systems

Products:

campcodes Complete Web-Based School Management System

Versions: 1.0

Operating Systems: Any OS running PHP and MySQL/MariaDB

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all installations of version 1.0. Requires PHP and database backend (typically MySQL/MariaDB).

📦 What is this software?

Complete Web Based School Management System by Campcodes

View all CVEs affecting Complete Web Based School Management System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including sensitive student/teacher data exfiltration, administrative account takeover, and potential remote code execution on the database server.

🟠

Likely Case

Unauthorized data access and modification, potentially exposing personally identifiable information (PII) and academic records.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing SQL injection.

🌐 Internet-Facing: HIGH - Web application accessible from internet with SQL injection vulnerability.

🏢 Internal Only: MEDIUM - Lower exposure but still significant risk if internal network is compromised.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires access to the add_friends.php endpoint, which may require authentication. SQL injection is well-understood with many available tools.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: None known

Restart Required: No

Instructions:

No official patch available. Implement parameterized queries in add_friends.php and validate/sanitize all user inputs.

🔧 Temporary Workarounds

Web Application Firewall (WAF)

all

Deploy WAF with SQL injection protection rules to block malicious requests.

Input Validation

all

Implement strict input validation for friend_index parameter to accept only expected values.

🧯 If You Can't Patch

Disable or restrict access to add_friends.php endpoint
Implement network segmentation and restrict database access to application server only

🔍 How to Verify

Check if Vulnerable:

Test add_friends.php endpoint with SQL injection payloads in friend_index parameter. Check if error messages reveal database structure or if payloads execute.

Check Version:

Check software version in admin panel or configuration files. Look for version 1.0 in system files.

Verify Fix Applied:

Test with SQL injection payloads after implementing parameterized queries. Verify no database errors are returned and payloads are rejected.

📡 Detection & Monitoring

Log Indicators:

SQL syntax errors in application logs
Unusual database queries from web server
Multiple failed login attempts followed by add_friends.php access

Network Indicators:

HTTP requests to add_friends.php with SQL keywords in parameters
Unusual database traffic patterns

SIEM Query:

source="web_logs" AND uri="/add_friends.php" AND (param="friend_index" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "' OR '")

📊 Metadata

CVE ID: CVE-2024-33405

CVSS v3 Score: 8.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE: CWE-89

Published: May 6, 2024

Last Updated: March 25, 2025

🔗 References

https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf Exploit,Third Party Advisory
https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf Exploit,Third Party Advisory
https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf Exploit,Third Party Advisory
https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-33405, you might also want to check these: