CVE-2024-34934 - SQL Injection Vulnerability in Campcodes Complete Web-Based School Management System 1.

Nowadays, schools have started relying on web-based school management systems for effective organizational functioning. The Campcodes Complete Web-Based School Management System is one such platform that caters to the educational institutions' administrative needs. Unfortunately, a recent vulnerability in this system has surfaced, allowing attackers unauthorized access to sensitive data.

In this article, we will discuss the SQL injection vulnerability, identified as CVE-2024-34934, in Campcodes Complete Web-Based School Management System 1.. This vulnerability affects the /view/emarks_range_grade_update_form.php file and can be exploited by an attacker to execute arbitrary SQL commands via the conversation_id parameter. We will also discuss the original references, code snippets, and exploit details involved in this vulnerability, enabling organizations to implement necessary security measures and protect sensitive data from exploitation.

Vulnerability Details

The vulnerability resides in the /view/emarks_range_grade_update_form.php file of the Campcodes Complete Web-Based School Management System 1.. It occurs due to insufficient sanitation of the conversation_id parameter passed to the script.

The following code snippet demonstrates the vulnerable script

<?php
    $conversation_id = $_GET['conversation_id'];
    $query = "SELECT * FROM teachers' WHERE conversation_id = '$conversation_id';";
    $result = mysqli_query($con, $query);
?>

In this code snippet, the conversation_id parameter is fetched directly from the $_GET variable and used without proper sanitization in the SQL query. This allows an attacker to perform an SQL injection attack by injecting malicious SQL statements into the conversation_id parameter, which can alter the original query's purpose and lead to unauthorized access and data manipulation.

Exploit Details

To exploit the vulnerability, an attacker can craft a malicious URL with an SQL injection payload in the conversation_id parameter. For example:

https://target.com/path_to_application/view/emarks_range_grade_update_form.php?conversation_id=1%27%20OR%201=1--

In this exploitation example, an attacker manipulates the conversation_id parameter with an SQL injection payload %27%20OR%201=1--, which causes the original SQL query to always return true, bypassing any access control in place.

The attack described here can be more destructive if the attacker uses different SQL payloads, such as extracting sensitive data, modifying data, and even executing system commands in some cases.

Original References

The vulnerability was initially reported and documented by security researchers and is available in the following public databases:

- National Institute of Standards and Technology (NIST) - NVD
- CVE Details - CVE-2024-34934

Mitigation and Conclusion

To mitigate the vulnerability related to CVE-2024-34934, it is necessary for the developers of the Campcodes Complete Web-Based School Management System to implement proper input validation, sanitation measures, and parameterized queries to prevent SQL injection attacks. Additionally, administrators of the system should keep the software updated to the latest versions and apply security patches as soon as they are available.

In summary, the CVE-2024-34934 vulnerability is an SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1., affecting the /view/emarks_range_grade_update_form.php file. This vulnerability can be exploited by an attacker to execute arbitrary SQL commands via the conversation_id parameter. Understanding the exploit details, reviewing the original references, and implementing the mitigation steps can help organizations protect their sensitive data from being accessed by unauthorized users.

Timeline

Published on: 05/23/2024 17:15:30 UTC
Last modified on: 08/20/2024 15:35:13 UTC