CVE-2024-5112
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows remote attackers to manipulate database queries through the std_index parameter in /view/student_profile.php. Attackers can potentially read, modify, or delete sensitive student and school data. All users running version 1.0 of this web application are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to execute arbitrary commands.
Likely Case
Unauthorized access to sensitive student records, grades, personal information, and potential privilege escalation within the system.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit details are available in GitHub repositories, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative school management systems or implementing custom fixes with proper input validation and parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests to /view/student_profile.php
Input Validation Filter
allImplement server-side input validation to sanitize the std_index parameter before processing
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database access attempts
🔍 How to Verify
Check if Vulnerable:
Test the /view/student_profile.php endpoint with SQL injection payloads in the std_index parameter and observe database errors or unexpected behaviorCheck Version:
Check the application's version information in the admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in URL parameters
- Multiple failed database queries from single IP
- Access to /view/student_profile.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in std_index parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND url="*student_profile.php*" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR 1=1*")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf
- https://vuldb.com/?ctiid.265102
- https://vuldb.com/?id.265102
- https://vuldb.com/?submit.338516
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf
- https://vuldb.com/?ctiid.265102
- https://vuldb.com/?id.265102
- https://vuldb.com/?submit.338516
