CVE-2024-5106
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows attackers to manipulate database queries through the /view/student_payment_details3.php endpoint. Remote attackers can potentially access, modify, or delete sensitive student and school data. All users running version 1.0 are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including student records, financial data, administrative credentials, and potential system takeover.
Likely Case
Data exfiltration of sensitive student information and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions in place.
🎯 Exploit Status
Public exploit available via GitHub repository; remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider migrating to a supported alternative or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement parameterized queries and input validation for the 'index' parameter in student_payment_details3.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM payments WHERE id = ?'); $stmt->bind_param('i', $index);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Configure WAF to block requests containing SQL keywords like UNION, SELECT, INSERT targeting /view/student_payment_details3.php
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules
- Implement database user with minimal required permissions
🔍 How to Verify
Check if Vulnerable:
Test the /view/student_payment_details3.php endpoint with SQL injection payloads in the 'index' parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed SQL syntax errors in application logs
- Requests to student_payment_details3.php with SQL keywords
Network Indicators:
- HTTP requests containing SQL injection patterns to vulnerable endpoint
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/view/student_payment_details3.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "INSERT")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2011.pdf
- https://vuldb.com/?ctiid.265096
- https://vuldb.com/?id.265096
- https://vuldb.com/?submit.338509
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2011.pdf
- https://vuldb.com/?ctiid.265096
- https://vuldb.com/?id.265096
- https://vuldb.com/?submit.338509
