CVE-2024-5114
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'index' parameter in the /view/teacher_attendance_history1.php file. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/teacher data theft, system takeover, or data destruction
Likely Case
Unauthorized access to attendance records and personal information, potential data manipulation
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Public exploit available on GitHub; simple SQL injection requiring minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allImplement proper input validation and use prepared statements/parameterized queries for all database operations
Modify /view/teacher_attendance_history1.php to use prepared statements
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Configure WAF to block SQL injection patterns
🧯 If You Can't Patch
- Restrict network access to only trusted IP addresses
- Implement database user with minimal required permissions
🔍 How to Verify
Check if Vulnerable:
Test the /view/teacher_attendance_history1.php endpoint with SQL injection payloads in the 'index' parameterCheck Version:
Check system version in admin panel or configuration filesVerify Fix Applied:
Test that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to teacher_attendance_history1.php with suspicious parameters
Network Indicators:
- SQL keywords in HTTP GET parameters
- Unusual database query patterns
SIEM Query:
source="web_logs" AND uri="/view/teacher_attendance_history1.php" AND (param="index" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|\/\*)")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf
- https://vuldb.com/?ctiid.265104
- https://vuldb.com/?id.265104
- https://vuldb.com/?submit.338518
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf
- https://vuldb.com/?ctiid.265104
- https://vuldb.com/?id.265104
- https://vuldb.com/?submit.338518
