CVE-2024-5108
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'index' parameter in the /view/student_payment_details4.php file. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 of this web application are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/payment data theft, administrative account takeover, and potential system-wide data destruction
Likely Case
Unauthorized access to student payment records, personal information exposure, and potential data manipulation
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure
🎯 Exploit Status
Public exploit details available in GitHub repository. SQL injection via GET parameter manipulation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
# Example ModSecurity rule for Apache:
SecRule ARGS:index "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt on student_payment_details4.php'"
# Example nginx WAF rule:
location ~* /view/student_payment_details4\.php$ { set $block_sqli 0; if ($args ~* "(?i)(union|select|insert|update|delete|drop|--|#|\/\*|\*\/)") { set $block_sqli 1; } if ($block_sqli = 1) { return 403; } }
Input Validation Filter
allAdd input validation to sanitize the 'index' parameter before processing
<?php
// Add to student_payment_details4.php before SQL execution
$index = filter_var($_GET['index'], FILTER_VALIDATE_INT);
if ($index === false || $index <= 0) {
die('Invalid parameter');
}
// Use parameterized query:
$stmt = $pdo->prepare('SELECT * FROM payments WHERE id = ?');
$stmt->execute([$index]);
?>
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from sensitive databases
- Deploy database monitoring to detect unusual SQL queries and access patterns
🔍 How to Verify
Check if Vulnerable:
Test by accessing /view/student_payment_details4.php?index=1' OR '1'='1 and checking for SQL errors or unexpected behaviorCheck Version:
Check application files for version information or review installation documentationVerify Fix Applied:
Test with SQL injection payloads after implementing fixes - should return error messages or no data instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple rapid requests to /view/student_payment_details4.php with SQL-like parameters
- Database logs showing unexpected queries from web application user
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in GET parameters
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_server" AND (url="/view/student_payment_details4.php" AND (param="index" AND value="*'*" OR value="*--*" OR value="*UNION*" OR value="*SELECT*"))🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2013.pdf
- https://vuldb.com/?ctiid.265098
- https://vuldb.com/?id.265098
- https://vuldb.com/?submit.338512
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2013.pdf
- https://vuldb.com/?ctiid.265098
- https://vuldb.com/?id.265098
- https://vuldb.com/?submit.338512
