CVE-2024-35349
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the id parameter in the /admin/category/view_category.php file in Diño Physics School Assistant. This affects all users running version 2.3 of the software, potentially compromising the entire database.
💻 Affected Systems
- Diño Physics School Assistant
📦 What is this software?
Dino Physics School Assistant by Dino Physics School Assistant Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution if database permissions allow.
Likely Case
Data exfiltration from the database, privilege escalation, and potential administrative access to the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Time-based blind SQL injection technique described in public references, making exploitation straightforward for attackers with basic SQL knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement workarounds or migrate to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure id parameter contains only numeric values
Modify /admin/category/view_category.php to validate $_GET['id'] with is_numeric() or ctype_digit()
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test the /admin/category/view_category.php endpoint with SQL injection payloads like: id=1' AND SLEEP(5)--Check Version:
Check application configuration files or admin panel for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer cause delayed responses or database errors📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests with SQL keywords in id parameter
- Requests to /admin/category/view_category.php with non-numeric id values
Network Indicators:
- HTTP requests containing SQL keywords like UNION, SELECT, SLEEP, or WAITFOR in URL parameters
SIEM Query:
source="web_logs" AND url="*/admin/category/view_category.php*" AND (id="*'*" OR id="*UNION*" OR id="*SELECT*" OR id="*SLEEP*")