CVE-2024-6067
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Music Class Enrollment System 1.0 allows attackers to manipulate database queries through the 'id' parameter in the /mces/?p=class/view_class endpoint. Attackers can potentially read, modify, or delete database contents, and the vulnerability can be exploited remotely without authentication. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Music Class Enrollment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to administrative access, and potential remote code execution if database configuration permits.
Likely Case
Unauthorized data access, data exfiltration, and potential authentication bypass leading to unauthorized system access.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation straightforward for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually, or replace with alternative software.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /mces/?p=class/view_class endpoint with id parameter manipulation.
Input Validation Filter
allAdd server-side input validation to sanitize the 'id' parameter, allowing only numeric values.
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input validation
- Implement network segmentation to restrict database access from the web application server
🔍 How to Verify
Check if Vulnerable:
Test the /mces/?p=class/view_class endpoint with SQL injection payloads in the id parameter (e.g., id=1' OR '1'='1). Monitor for database errors or unexpected responses.Check Version:
Check the application's version information in the admin panel or configuration files. The vulnerable version is 1.0.Verify Fix Applied:
After implementing fixes, retest with SQL injection payloads to ensure they are properly blocked or sanitized without affecting legitimate functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /mces/?p=class/view_class with suspicious id parameter values
- Database query errors containing SQL syntax
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND url="/mces/?p=class/view_class" AND (param="id" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and|'|--|#|;)")🔗 References
- https://github.com/jadu101/CVE/blob/main/SourceCodester-Musical-Class-Enrollment-System-SQLi.md
- https://vuldb.com/?ctiid.268795
- https://vuldb.com/?id.268795
- https://vuldb.com/?submit.358566
- https://github.com/jadu101/CVE/blob/main/SourceCodester-Musical-Class-Enrollment-System-SQLi.md
- https://vuldb.com/?ctiid.268795
- https://vuldb.com/?id.268795
- https://vuldb.com/?submit.358566
