CVE-2024-34479
📋 TL;DR
This vulnerability allows SQL injection through the id parameter in classes/Master.php in SourceCodester Computer Laboratory Management System 1.0. Attackers can execute arbitrary SQL commands to manipulate or extract database contents. Organizations using this specific version of the software are affected.
💻 Affected Systems
- SourceCodester Computer Laboratory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, extraction of sensitive information (user credentials, lab data), and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection is a well-understood attack vector with many automated tools available. The public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize the id parameter in classes/Master.php
Edit classes/Master.php to implement parameterized queries or proper input filtering
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database access attempts
🔍 How to Verify
Check if Vulnerable:
Test the id parameter in classes/Master.php with SQL injection payloads like ' OR '1'='1Check Version:
Check the software version in the admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts from single IP
- Requests with SQL keywords in parameters
Network Indicators:
- Unusual database connection patterns
- Large data transfers from database server
SIEM Query:
source="web_logs" AND ("sql" OR "union" OR "select" OR "sleep" OR "benchmark") AND uri="*Master.php*"