CVE-2024-4907
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows attackers to manipulate database queries through the 'grade' parameter in /view/show_student2.php. Remote attackers can potentially access, modify, or delete sensitive student and school data. All users running version 1.0 are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive student records, grades, personal information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit details are available in GitHub repositories, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with input validation and parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'grade' parameter before processing
Modify /view/show_student2.php to validate grade parameter using PHP filter functions
Web Application Firewall Rules
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests to /view/show_student2.php containing SQL keywords in grade parameter
🧯 If You Can't Patch
- Isolate the system on a segmented network with strict access controls
- Implement database-level protections: restrict application database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Test the /view/show_student2.php endpoint with SQL injection payloads in the grade parameter (e.g., grade=1' OR '1'='1)Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Test with SQL injection payloads after implementing fixes - should return error or sanitized response📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /view/show_student2.php with suspicious grade parameters
- Database query patterns with unexpected UNION or SELECT statements
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT) in URL parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/view/show_student2.php" AND (param="grade" AND value MATCH "'.*[Uu][Nn][Ii][Oo][Nn].*'" OR value MATCH "'.*[Ss][Ee][Ll][Ee][Cc][Tt].*'")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf
- https://vuldb.com/?ctiid.264442
- https://vuldb.com/?id.264442
- https://vuldb.com/?submit.333293
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf
- https://vuldb.com/?ctiid.264442
- https://vuldb.com/?id.264442
- https://vuldb.com/?submit.333293
