CVE-2024-5378
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester School Intramurals Student Attendance Management System 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in /manage_sy.php. Attackers can remotely exploit this to access, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester School Intramurals Student Attendance Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student attendance data, personal information exposure, and potential data manipulation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests to /manage_sy.php
Input Validation Filter
allImplement server-side input validation to sanitize the 'id' parameter before processing
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all traffic to /manage_sy.php endpoint
🔍 How to Verify
Check if Vulnerable:
Test the /manage_sy.php endpoint with SQL injection payloads in the 'id' parameter (e.g., id=1' OR '1'='1)Check Version:
Check the software version in the admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /manage_sy.php with SQL syntax in parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
SIEM Query:
source="web_logs" AND url="/manage_sy.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*1=1*")