CVE-2024-35358
📋 TL;DR
This vulnerability allows attackers to perform SQL injection attacks on Diño Physics School Assistant version 2.3 by manipulating the 'id' parameter in the /classes/Master.php?f=view_category endpoint. Successful exploitation could lead to unauthorized database access, data theft, or manipulation. All users running the vulnerable version are affected.
💻 Affected Systems
- Diño Physics School Assistant
📦 What is this software?
Dino Physics School Assistant by Dino Physics School Assistant Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, modification, or deletion, potentially leading to full system takeover if database privileges permit.
Likely Case
Unauthorized access to sensitive student/teacher data, grade manipulation, or extraction of administrative credentials.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Time-based blind SQL injection requires automated tools but is well-documented in security community.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches
3. Verify fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Input Validation Filter
allImplement server-side validation to sanitize 'id' parameter before processing
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules
- Implement database user with minimal required privileges
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /classes/Master.php?f=view_category with SQL injection payloads in the 'id' parameter and observe time delaysCheck Version:
Check application configuration or admin panel for version informationVerify Fix Applied:
Retest with SQL injection payloads after applying fixes; successful payloads should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /classes/Master.php with suspicious 'id' parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, SLEEP) in URL parameters
SIEM Query:
source="web_logs" AND url="/classes/Master.php" AND (param="id" AND value CONTAINS "' OR ")