CVE-2024-35356
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the 'id' parameter in Diño Physics School Assistant version 2.3. Attackers can potentially read, modify, or delete database contents. All users running the vulnerable version are affected.
💻 Affected Systems
- Diño Physics School Assistant
📦 What is this software?
Dino Physics School Assistant by Dino Physics School Assistant Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion of critical educational records and user information.
Likely Case
Unauthorized access to sensitive student/teacher data, grade manipulation, or extraction of database credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Error-based SQL injection makes exploitation straightforward with common SQL injection tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify Master.php to implement proper input validation and use prepared statements for database queries.
Edit /classes/Master.php to replace raw SQL queries with parameterized queries using PDO or mysqli prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Add WAF rule: deny requests to /classes/Master.php?f=save_item containing SQL keywords in id parameter
🧯 If You Can't Patch
- Restrict network access to the application to trusted users only
- Implement database user with minimal necessary permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /classes/Master.php?f=save_item?id=1' with SQL injection payloads and observe error responsesCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test the same endpoint with SQL injection payloads and verify no database errors are returned📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /classes/Master.php?f=save_item with SQL keywords in parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL injection patterns (UNION, SELECT, etc.) in URL parameters
SIEM Query:
source="web_logs" AND url="/classes/Master.php" AND (param="id" AND value CONTAINS "' OR ")