CVE-2024-5110
📋 TL;DR
This is a critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0. Attackers can remotely exploit the /view/student_payment_invoice.php file to execute arbitrary SQL commands. All users running the affected version are vulnerable.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Data exfiltration of sensitive student/payment information, database manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns.
🎯 Exploit Status
Public exploit details are available in GitHub repositories. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify the vulnerable PHP file to use prepared statements with parameterized queries instead of direct string concatenation.
Edit /view/student_payment_invoice.php to replace raw SQL with PDO or mysqli prepared statements
WAF Rule Implementation
allDeploy a web application firewall with SQL injection detection rules to block exploitation attempts.
Configure WAF rules to detect and block SQL injection patterns in the 'index' parameter
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using IP whitelisting or authentication requirements
- Implement database user privilege reduction to limit potential damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Test the /view/student_payment_invoice.php endpoint with SQL injection payloads in the 'index' parameterCheck Version:
Check the system version in the admin panel or configuration filesVerify Fix Applied:
Attempt SQL injection tests against the patched endpoint and verify they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to /view/student_payment_invoice.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in the 'index' parameter
SIEM Query:
source="web_server" AND uri="/view/student_payment_invoice.php" AND (param="index" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|create|alter)")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf
- https://vuldb.com/?ctiid.265100
- https://vuldb.com/?id.265100
- https://vuldb.com/?submit.338514
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf
- https://vuldb.com/?ctiid.265100
- https://vuldb.com/?id.265100
- https://vuldb.com/?submit.338514
