CVE-2024-7166
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester School Fees Payment System 1.0 that allows attackers to manipulate database queries through the ef_id parameter in /receipt.php. Attackers can exploit this remotely to potentially access, modify, or delete sensitive data. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester School Fees Payment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive student/financial data, administrative account takeover, and potential system destruction
Likely Case
Data exfiltration of payment records, student information, and system credentials
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data
🎯 Exploit Status
Public exploit code is available, making attacks trivial for attackers with basic SQLi knowledge
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement workarounds or replace with alternative software.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify /receipt.php to validate ef_id parameter and use prepared statements
Edit /receipt.php to replace raw SQL with parameterized queries using PDO or mysqli
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: deny requests with SQL keywords in ef_id parameter
🧯 If You Can't Patch
- Block external access to the system using network firewalls
- Implement strict database user permissions with least privilege
🔍 How to Verify
Check if Vulnerable:
Test /receipt.php with SQL injection payloads in ef_id parameter (e.g., ef_id=1' OR '1'='1)Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads after fixes - should return error or no data leakage📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to /receipt.php with suspicious parameters
Network Indicators:
- SQL keywords in HTTP GET parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/receipt.php" AND (param="ef_id" AND value MATCH "'|OR|UNION|SELECT")🔗 References
- https://gist.github.com/topsky979/8ab4ff5ffb2a555694931d14329f5a5d
- https://vuldb.com/?ctiid.272580
- https://vuldb.com/?id.272580
- https://vuldb.com/?submit.380180
- https://gist.github.com/topsky979/8ab4ff5ffb2a555694931d14329f5a5d
- https://vuldb.com/?ctiid.272580
- https://vuldb.com/?id.272580
- https://vuldb.com/?submit.380180
