A security researcher has recently discovered and reported on a vulnerability detected within the Diño Physics School Assistant software, specifically version 2.3. This vulnerability has been assigned the identifier CVE-2024-35349. The issue resides in an unidentified portion of the PHP code within the /admin/category/view_category.php file and can be potentially exploited through SQL injection attacks. This post aims to provide an overview of the vulnerability, as well as details on the potential exploit and mitigation measures to protect against this threat.

Description of the Vulnerability

The CVE-2024-35349 vulnerability pertains to a potentially dangerous code section within the /admin/category/view_category.php file of Diño Physics School Assistant version 2.3. By manipulating the "id" argument, an attacker can inject SQL code into this section, opening the door for SQL injection attacks. These types of attacks can lead to unauthorized access to sensitive data, application, and even system-level control.

The code snippet containing the vulnerability in view_category.php is as follows

$query = "SELECT * FROM categories WHERE id = ".$_GET['id'];
$result = mysqli_query($link, $query);

In this code snippet, the "id" value is directly passed into the SQL query without proper validation or sanitization, enabling an attacker to manipulate it and inject custom SQL code.

Exploit Details

An attacker can exploit the vulnerability by sending a malicious HTTP request containing an SQL injection payload to the target server. The injected payload aims to manipulate the SQL query and allow the attacker to carry out unauthorized actions on the web application. For example, the attacker could execute the following payload:

http://TARGET_ADDRESS/admin/category/view_category.php?id=1+OR+1=1--

This payload would allow the attacker to potentially bypass login restrictions, access users' data, and perform any actions that a legitimate user or administrator could perform.

The vulnerability (CVE-2024-35349) was initially disclosed on the following sources

- CVE Details: https://www.cvedetails.com/cve/CVE-2024-35349/
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-35349

To protect against this SQL injection vulnerability, administrators are advised to

1. Update the Diño Physics School Assistant software to the latest available version, which might contain patches for the vulnerability.
2. Implement proper input validation and sanitization techniques for user-supplied data, particularly those that are used to construct SQL queries. This would help reduce the risk of SQL injection attacks.
3. Limit the privileges of database accounts used by the web application, ensuring that they only have the necessary access rights to perform their intended functions.
4. Regularly monitor and review PHP error logs and system logs for any suspicious activities or signs of exploitation attempts.

Conclusion

The CVE-2024-35349 vulnerability within Diño Physics School Assistant v2.3 is a serious issue that can potentially lead to unauthorized data access and system control. Administrators are strongly advised to implement the recommended mitigation measures to secure their installations against this vulnerability and prevent attackers from exploiting it.

Timeline

Published on: 05/30/2024 17:15:33 UTC
Last modified on: 08/01/2024 13:52:38 UTC