CVE-2024-5381
📋 TL;DR
This critical SQL injection vulnerability in itsourcecode Student Information Management System 1.0 allows attackers to manipulate database queries through the studentId parameter in view.php. Remote attackers can potentially access, modify, or delete sensitive student information. All deployments of version 1.0 with the vulnerable file are affected.
💻 Affected Systems
- itsourcecode Student Information Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion of all student records, potentially leading to authentication bypass or system takeover.
Likely Case
Unauthorized access to sensitive student information (names, addresses, grades) and potential data exfiltration or modification.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries or input validation in view.php, or replace with a supported version if available.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure studentId parameter contains only expected characters (numbers)
Edit view.php to add: if(!is_numeric($_GET['studentId'])) { die('Invalid input'); }
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the studentId parameter
Add WAF rule: Detect and block SQL keywords in studentId parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test by accessing view.php with a malicious studentId parameter like: view.php?studentId=1' OR '1'='1Check Version:
Check the system documentation or about page, or examine file headers for version informationVerify Fix Applied:
Test the same SQL injection attempts after implementing fixes to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed parameter validation attempts
- Requests with SQL keywords in studentId parameter
Network Indicators:
- Unusual database query patterns from web server
- Large data transfers from database to external IPs
SIEM Query:
source=web_logs AND (uri="*view.php*" AND (param="*studentId=*'*" OR param="*studentId=*%27*" OR param="*studentId=*OR*"))