CVE-2024-34933 - SQL Injection Vulnerability Found in Campcodes Complete Web-based School Management System 1.

A critical SQL injection vulnerability has been discovered in Campcodes Complete Web-Based School Management System 1.. This vulnerability is tracked under the Common Vulnerabilities and Exposures (CVE) identifier CVE-2024-34933. SQL injection attacks can allow the attackers to bypass security measures, view, modify, or delete database contents, and even execute arbitrary code on the underlying server.

Summary and Impact

The vulnerability is present in the /model/update_grade.php file of the web-based management system and it can be exploited through the admission_fee parameter. Unsanitized user input can lead to potential attackers executing arbitrary SQL commands by exploiting this vulnerability. Users of the Campcodes Complete Web-Based School Management System 1. are strongly advised to apply patches and security fixes as soon as possible to protect against threats.

Details of the Vulnerability

The vulnerability occurs in the update_grade.php file in the Campcodes Complete Web-Based School Management System 1.. The code snippet below highlights the affected lines of code:

$sql = "UPDATE grade SET
          admission_fee = '" . $_POST['admission_fee'] . "'
        WHERE id = $grade_id";

In the above code snippet, the admission_fee parameter value is directly taken from the POST request without proper input sanitization or validation. This allows an attacker to manipulate the admission_fee parameter and inject arbitrary SQL code to be executed by the database server.

Exploit Details

An attacker can exploit the vulnerability by crafting an HTTP POST request to the target web-based management system's /model/update_grade.php endpoint. The following example demonstrates an exploit payload that injects malicious SQL code into the admission_fee parameter:

POST /model/update_grade.php HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

admission_fee=100';DROP TABLE users; --

With this exploit, the attacker can potentially delete the users table from the underlying database, causing significant damage to the web-based management system.

Workarounds and Mitigations

Campcodes users are advised to apply patches or security fixes as soon as they become available. In the meantime, they can take the following steps to protect their web-based management system from this vulnerability:

1. Apply input validation and sanitization to the admission_fee parameter before including it in the SQL query.
2. Use prepared statements or parameterized queries to avoid direct concatenation of user input in SQL queries.
3. Implement a Web Application Firewall (WAF) to block malicious requests containing SQL injection payloads.

Original References

More details about the vulnerability can be found in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2024-34933

Campcodes Complete Web-Based School Management System: https://www.campcodes.com/school-management-system/

Conclusion

CVE-2024-34933 is a critical SQL injection vulnerability in the Campcodes Complete Web-Based School Management System 1., which allows attackers to execute arbitrary SQL commands via the admission_fee parameter. It is crucial for affected users to apply patches or security fixes as soon as possible. In the meantime, the suggested workarounds and mitigations can help protect against potential attacks.

Timeline

Published on: 05/23/2024 17:15:30 UTC
Last modified on: 07/03/2024 02:00:58 UTC