CVE-2024-33410
📋 TL;DR
This SQL injection vulnerability in campcodes Complete Web-Based School Management System 1.0 allows attackers to execute arbitrary SQL commands through the id parameter in the /model/delete_range_grade.php endpoint. Attackers can potentially read, modify, or delete database contents, including sensitive student and school data. All deployments of version 1.0 are affected.
💻 Affected Systems
- campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to sensitive student records, grade manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions, potentially only error messages or limited data exposure.
🎯 Exploit Status
SQL injection via GET/POST parameter requires minimal technical skill. Public proof-of-concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /model/delete_range_grade.php endpoint and id parameter.
Input Validation Filter
allAdd input validation to only accept numeric values for the id parameter before processing.
<?php
if (!is_numeric($_GET['id']) && !is_numeric($_POST['id'])) {
die('Invalid input');
}
?>
🧯 If You Can't Patch
- Block external access to the vulnerable endpoint using firewall rules or web server configuration.
- Implement database user permission restrictions to limit damage from successful exploitation.
🔍 How to Verify
Check if Vulnerable:
Test the /model/delete_range_grade.php endpoint with SQL injection payloads like ' OR '1'='1 in the id parameter and observe database errors or unexpected behavior.Check Version:
Check application version in admin panel or review source code for version markers.Verify Fix Applied:
After implementing workarounds, test with the same SQL injection payloads and verify they are blocked or properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /model/delete_range_grade.php with suspicious id parameter values
- Database query patterns showing UNION SELECT or other SQL injection constructs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
- Abnormal traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND (url_path="/model/delete_range_grade.php" AND (param="id" AND value MATCH "'.*[Ss][Ee][Ll][Ee][Cc][Tt].*'" OR value MATCH "'.*[Uu][Nn][Ii][Oo][Nn].*'"))🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%209.pdf
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%209.pdf
