CVE-2024-4926
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester School Intramurals Student Attendance Management System 1.0. Attackers can manipulate the 'id' parameter in /intrams_sams/manage_student.php to execute arbitrary SQL commands remotely. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester School Intramurals Student Attendance Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized access to student attendance data, personal information exposure, and potential system takeover.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Public exploit code exists on GitHub. Attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify manage_student.php to use prepared statements and validate the 'id' parameter
Replace vulnerable SQL queries with PDO or mysqli prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Configure WAF to block SQL injection patterns in POST/GET parameters
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test the /intrams_sams/manage_student.php endpoint with SQL injection payloads in the 'id' parameterCheck Version:
Check system documentation or about page for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests with SQL keywords in parameters
- Requests to manage_student.php with suspicious 'id' values
Network Indicators:
- SQL syntax in HTTP parameters
- Database error responses in HTTP traffic
SIEM Query:
source="web_server" AND (url="*manage_student.php*" AND (param="*id=*UNION*" OR param="*id=*SELECT*" OR param="*id=*OR*"))