CVE-2024-50823

Executive Summary

CVE-2024-50823 is a critical SQL Injection vulnerability discovered in the Kashipara E-learning Management System Project version 1.0. The flaw resides in the /admin/login.php script, where both the username and password parameters are directly concatenated into SQL queries without proper sanitization or parameterization. This allows an unauthenticated attacker to bypass authentication, extract sensitive data, or potentially achieve remote code execution via stacked queries. The vulnerability has a public proof-of-concept (PoC) but no official patch is available as of this report. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the simplicity of exploitation.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this software should treat it as a supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data, but based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full database access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Could lead to denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the login mechanism. The PHP code in /admin/login.php likely constructs a query similar to:

$sql = "SELECT * FROM admin WHERE username = '$_POST[username]' AND password = '$_POST[password]'";

An attacker can inject SQL metacharacters into either parameter to manipulate the query. For example, using ' OR '1'='1 as the username and any password will result in:

SELECT * FROM admin WHERE username = '' OR '1'='1' AND password = 'anything'

This always returns a valid row, bypassing authentication. More advanced payloads can extract data using UNION-based injection or time-based blind techniques.

The vulnerability is present in version 1.0 of the Kashipara E-learning Management System. No patched version has been released.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical reconstruction):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM admin WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
    // login success
} else {
    // login failed
}
?>

Patched Code (using prepared statements):

<?php
$stmt = $conn->prepare("SELECT * FROM admin WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$username = $_POST['username'];
$password = $_POST['password'];
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // login success
} else {
    // login failed
}
?>

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Kashipara E-learning Management System 1.0.
• Network access to /admin/login.php.

Exploitation Steps:

1. Bypass Authentication:

   • Username: ' OR '1'='1' -- -
   • Password: anything
   • This logs in as the first admin user.

2. Extract Data (UNION-based):

   • Username: ' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -
   • Password: x
   • Adjust column count based on error messages.

3. Time-Based Blind Injection:

   • Username: ' OR IF(1=1, SLEEP(5), 0) -- -
   • Password: x
   • Observe response delay.

Example SQLMap Command:

sqlmap -u "http://target.com/admin/login.php" --data="username=admin&password=test" --batch --dump

Blue Team

Detection:

• Monitor for SQL injection patterns in HTTP POST parameters to /admin/login.php.
• Look for unusual characters like single quotes ('), double dashes (--), or OR/AND keywords.
• Alert on response times exceeding normal thresholds (time-based injection).

Hunting:

• Search logs for username or password parameters containing SQL keywords.
• Correlate with failed login attempts followed by successful login from the same IP.

Mitigation:

• Immediately apply input validation and parameterized queries.
• If patching is not possible, deploy a Web Application Firewall (WAF) with SQL injection rules.
• Restrict access to /admin/login.php via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/login.php with SQL-like payloads in username or password fields.
  • Unusual response sizes or error messages containing SQL syntax.
• Host:
  • Unexpected database queries in MySQL logs (e.g., SELECT * FROM admin WHERE username = '' OR '1'='1').
  • New admin users created in the database.
• File:
  • Modified PHP files in the web root (e.g., webshells uploaded via INTO OUTFILE).

Detection Engineering

YARA Rule

rule CVE_2024_50823_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts targeting Kashipara E-learning login"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-50823"
    strings:
        $sqli1 = /username=.*['\"]\s*(OR|AND)\s+['\"]?1['\"]?\s*=\s*['\"]?1/i
        $sqli2 = /password=.*['\"]\s*(OR|AND)\s+['\"]?1['\"]?\s*=\s*['\"]?1/i
        $sqli3 = /username=.*UNION\s+SELECT/i
        $sqli4 = /password=.*SLEEP\s*\(/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on Kashipara E-learning Login
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP POST requests to /admin/login.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/login.php
        cs-uri-query|contains:
            - "' OR '1'='1"
            - "' OR 1=1"
            - "UNION SELECT"
            - "SLEEP("
    condition: selection
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-50823 SQL Injection Attempt on Kashipara E-learning Login";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/login.php"; http_uri;
    content:"username="; http_client_body;
    pcre:"/username=[^&]*['\"]\s*(OR|AND)\s+['\"]?1['\"]?\s*=\s*['\"]?1/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the /admin/login.php endpoint if not required.
   • Apply input validation (whitelist allowed characters) for username and password fields.
   • Use parameterized queries (prepared statements) in all database interactions.

2. Long-Term Fix:

   • Upgrade to a patched version if the vendor releases one.
   • If no patch is available, consider migrating to a different, actively maintained e-learning platform.

3. Compensating Controls:

   • Deploy a WAF with SQL injection signatures.
   • Implement network segmentation to limit database exposure.
   • Enable detailed logging and monitoring for all admin login attempts.

4. Validation:

   • After applying fixes, test with SQLMap or manual payloads to confirm the vulnerability is resolved.

Report generated by Valters IT DevSecOps & CTI Division. This document is intended for authorized security professionals only.