CVE-2024-51060
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the 'a_id' parameter in index.php of Projectworlds Online Admission System v1. This can lead to unauthorized data access, modification, or deletion. Organizations using this specific version of the admission system are affected.
💻 Affected Systems
- Projectworlds Online Admission System
📦 What is this software?
Online Admission System by Projectworlds
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive student admission data, personal information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting unauthorized operations.
🎯 Exploit Status
SQL injection via GET parameter requires minimal technical skill. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://projectworld.com
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. If no patch available, implement workarounds
3. Consider migrating to supported version
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'a_id' parameter before processing
// In index.php, add before SQL query:
$a_id = filter_var($_GET['a_id'], FILTER_VALIDATE_INT);
if (!$a_id) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns in the 'a_id' parameter
ModSecurity rule: SecRule ARGS:a_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Add strict database user permissions with least privilege access
🔍 How to Verify
Check if Vulnerable:
Test with payload: index.php?a_id=1' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payload and verify no SQL errors or unexpected behavior📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts following SQL errors
- Requests with SQL keywords in 'a_id' parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in GET parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND (uri="*index.php*" AND query="*a_id=*'*" OR query="*a_id=*%27*")