CVE-2024-8784
📋 TL;DR
This is a critical SQL injection vulnerability in QDocs Smart School Management System's chat component that allows attackers to execute arbitrary SQL commands. Attackers can exploit this remotely without authentication to potentially access, modify, or delete database content. All users running version 7.0.0 are affected.
💻 Affected Systems
- QDocs Smart School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/teacher data theft, system takeover, or data destruction
Likely Case
Data exfiltration of user information, chat logs, and potentially authentication credentials
If Mitigated
Limited impact if proper network segmentation and database permissions restrict damage
🎯 Exploit Status
Time-based blind SQL injection with public exploit details available; simple POST request manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.1
Vendor Advisory: https://smart-school.in/article/version-7-0-1
Restart Required: Yes
Instructions:
1. Backup database and application files. 2. Download version 7.0.1 from vendor. 3. Replace affected files. 4. Restart web server. 5. Verify functionality.
🔧 Temporary Workarounds
WAF Rule Implementation
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF-specific rules to block patterns containing SLEEP() and SQL keywords in POST parameters
Endpoint Restriction
linuxBlock access to the vulnerable chat endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/user/chat/mynewuser" --algo bm -j DROP
nginx: location ~ ^/user/chat/mynewuser { deny all; }
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all user inputs
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test POST request to /user/chat/mynewuser with SQL injection payload and measure response timeCheck Version:
Check application version in admin panel or config filesVerify Fix Applied:
Attempt same SQL injection test after patch - should return error or normal response without delay📡 Detection & Monitoring
Log Indicators:
- POST requests to /user/chat/mynewuser containing SQL keywords like SLEEP, SELECT, UNION
- Unusually long response times from chat endpoint
Network Indicators:
- SQL injection patterns in HTTP POST parameters
- Multiple rapid requests to chat endpoint with varying parameters
SIEM Query:
source="web_logs" AND uri_path="/user/chat/mynewuser" AND (http_method="POST") AND (request_body CONTAINS "SLEEP" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "UNION")🔗 References
- https://codecanyon.net/item/smart-school-school-management-system/19426018
- https://github.com/bytium/vulnerability-research/blob/main/Advisory%20for%20Time-Based%20Blind%20SQL%20Injection%20in%20QDocs%20Smart%20School.md
- https://smart-school.in/article/version-7-0-1
- https://vuldb.com/?ctiid.277435
- https://vuldb.com/?id.277435
- https://vuldb.com/?submit.407385
