CVE-2024-9091
📋 TL;DR
CVE-2024-9091 is a critical SQL injection vulnerability in code-projects Student Record System 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'regno' parameter in /index.php. This affects all users running the vulnerable version of this student management software. Successful exploitation could lead to complete database compromise.
💻 Affected Systems
- code-projects Student Record System
📦 What is this software?
Student Record System by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to student records, grade manipulation, personal data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting the attack surface.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub and vuldb. The SQL injection appears to be straightforward with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually, or replace with alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'regno' parameter before processing
Edit /index.php to add: if(!is_numeric($_GET['regno'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the regno parameter
ModSecurity rule: SecRule ARGS:regno "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the Student Record System behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test by sending a SQL injection payload to the regno parameter: /index.php?regno=1' OR '1'='1Check Version:
Check the application's version file or documentation, typically in README or about.phpVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages or are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL patterns
- Unexpected database queries from application user
Network Indicators:
- HTTP requests containing SQL keywords in regno parameter
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND (regno="*' OR*" OR regno="*UNION*" OR regno="*SELECT*" OR regno="*--*")